@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/scripts/daemon/lib/self-echo.test.mjs

@@ -0,0 +1,153 @@
+/**
+ * self-echo.test.mjs — the sender==self match that three production recurrences
+ * (2026-08-25 / 08-27 / 08-30) proved the old inline check could not make.
+ *
+ * Run: node --test scripts/daemon/lib/self-echo.test.mjs
+ *
+ * The load-bearing case is the REAL event shape: cohort inbox items carry the
+ * display name verbatim (`sender: "Isla Roselli"`), while the old filter
+ * compared against `fullName.toLowerCase().replace(/\s+/g, "-")` —
+ * "isla-roselli" — so the echo sailed through and the agent acked itself.
+ */
+
+import { test, describe, beforeEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { loadSelfIdentity, isSelfSender, normalizeName, logSelfEchoDrop, _resetSelfIdentity } from "./self-echo.mjs";
+
+const ROOT = mkdtempSync(join(tmpdir(), "self-echo-test-"));
+mkdirSync(join(ROOT, "config"), { recursive: true });
+writeFileSync(join(ROOT, "config", "agent.json"), JSON.stringify({
+  firstName: "Isla",
+  fullName: "Isla Roselli",
+  memberId: "cmqh0tcml004ihhl6zev6ocb5",
+  email: "isla@example.com",
+  org: { cohort: { agentId: "A016" } },
+}));
+
+beforeEach(() => _resetSelfIdentity());
+
+const me = () => loadSelfIdentity(ROOT);
+
+describe("normalizeName", () => {
+  test("folds case and the separator zoo to one comparable form", () => {
+    for (const v of ["Isla Roselli", "isla roselli", "isla-roselli", "Isla_Roselli", "isla.roselli", "  Isla   Roselli "]) {
+      assert.equal(normalizeName(v), "isla roselli", `"${v}" must normalise`);
+    }
+  });
+});
+
+describe("isSelfSender — the shapes real events actually carry", () => {
+  test("REGRESSION: the verbatim display name — the exact 25/27/30 Aug echo shape — matches", () => {
+    // Field-for-field the 30 Aug production echo (cmtfqjwvv01kype01t002t8jf):
+    const echo = {
+      id: "cohort-cmtfqjwvv01kype01t002t8jf",
+      service: "cohort",
+      channel: "dm-a016-a039",
+      sender: "Isla Roselli",
+      raw_ref: "cohort:dm:cmtfqjwvv01kype01t002t8jf:192025",
+      event_kind: "send",
+      is_dm: true,
+    };
+    assert.equal(isSelfSender(echo, me()), true);
+  });
+
+  test("the OLD filter's dashed form and other separator variants also match", () => {
+    for (const s of ["isla-roselli", "Isla_Roselli", "isla roselli"]) {
+      assert.equal(isSelfSender({ sender: s }, me()), true, `"${s}" is this agent`);
+    }
+  });
+
+  test("REGRESSION: the BARE first name alone is NOT self — it collides with every namesake", () => {
+    // "Isla" as a display name is any colleague, contact or CC'd person who
+    // shares the first name. Matching it dropped their genuine inbound.
+    assert.equal(isSelfSender({ sender: "Isla" }, me()), false);
+    assert.equal(isSelfSender({ sender: "isla" }, me()), false);
+  });
+
+  test("REGRESSION: a NON-matching id EXONERATES a colliding display name", () => {
+    // A namesake — display name "Isla Roselli", but a DIFFERENT member cuid.
+    // The id positively identifies the sender as someone else; the name rung
+    // must never be reached, so this is NOT self and must not be dropped.
+    assert.equal(
+      isSelfSender({ sender: "Isla Roselli", sender_id: "cmDIFFERENT00000000000000" }, me()),
+      false,
+      "an id that resolves to someone else outranks the name collision",
+    );
+    assert.equal(
+      isSelfSender({ sender: "isla-roselli", author_id: "cmDIFFERENT00000000000000" }, me()),
+      false,
+    );
+  });
+
+  test("REGRESSION: a NON-matching email exonerates a colliding display name too", () => {
+    assert.equal(
+      isSelfSender({ sender: "Isla Roselli", sender_email: "other.isla@example.com" }, me()),
+      false,
+    );
+    // …while the OWN email still matches regardless of the display name.
+    assert.equal(
+      isSelfSender({ sender: "totally different name", sender_email: "isla@example.com" }, me()),
+      true,
+    );
+  });
+
+  test("a member cuid on any id-ish field matches (strongest evidence)", () => {
+    for (const item of [
+      { sender: "someone", sender_id: "cmqh0tcml004ihhl6zev6ocb5" },
+      { sender: "someone", author_id: "CMQH0TCML004IHHL6ZEV6OCB5" },
+      { sender: "someone", from: { id: "cmqh0tcml004ihhl6zev6ocb5" } },
+    ]) {
+      assert.equal(isSelfSender(item, me()), true);
+    }
+  });
+
+  test("the org seat slug matches too", () => {
+    assert.equal(isSelfSender({ sender: "x", sender_id: "A016" }, me()), true);
+  });
+
+  test("own email matches (gmail/orgmail lanes)", () => {
+    assert.equal(isSelfSender({ sender: "Isla via mail", sender_email: "isla@example.com" }, me()), true);
+  });
+
+  test("genuine colleagues NEVER match — no false drops", () => {
+    for (const s of ["Jordan Blake", "Candace Wong", "Isla Fisher", "roselli", "isla2", "ceo"]) {
+      assert.equal(isSelfSender({ sender: s }, me()), false, `"${s}" must not be dropped`);
+    }
+    assert.equal(isSelfSender({ sender: "Candace Wong", sender_id: "cmOTHER000000000000000000" }, me()), false);
+  });
+
+  test("an UNCONFIGURED identity matches nothing — a half-set-up repo drops no inbound", () => {
+    const bare = mkdtempSync(join(tmpdir(), "self-echo-bare-"));
+    try {
+      const id = loadSelfIdentity(bare);
+      assert.equal(isSelfSender({ sender: "Isla Roselli" }, id), false);
+      assert.equal(isSelfSender({ sender: "Agent" }, id), false);
+    } finally {
+      rmSync(bare, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("logSelfEchoDrop — every drop is auditable", () => {
+  test("appends one JSONL row per drop under logs/daemon/", () => {
+    const item = { id: "e-1", raw_ref: "cohort:dm:e-1:42", sender: "Isla Roselli", channel: "dm-a016-a039", service: "cohort", event_kind: "send" };
+    logSelfEchoDrop(item, { stage: "poll", service: "cohort", agentRoot: ROOT });
+    logSelfEchoDrop(item, { stage: "process", service: "cohort", agentRoot: ROOT });
+    const rows = readFileSync(join(ROOT, "logs", "daemon", "self-echo-drops.jsonl"), "utf-8")
+      .split("\n").filter(Boolean).map((l) => JSON.parse(l));
+    assert.equal(rows.length, 2);
+    assert.equal(rows[0].stage, "poll");
+    assert.equal(rows[1].stage, "process");
+    assert.equal(rows[0].raw_ref, "cohort:dm:e-1:42");
+    assert.equal(rows[0].sender, "Isla Roselli");
+  });
+
+  test("never throws, even for a junk item", () => {
+    assert.doesNotThrow(() => logSelfEchoDrop(null, { agentRoot: ROOT }));
+    assert.doesNotThrow(() => logSelfEchoDrop(undefined, { agentRoot: join(ROOT, "no", "such", "deep") }));
+  });
+});

package/scripts/daemon/maestro-daemon.mjs

@@ -32,6 +32,9 @@ const AGENT_DIR = process.env.AGENT_DIR || resolve(__dirname, "../..");
 
 process.env.AGENT_DIR = AGENT_DIR;
 process.env.AGENT_ROOT = AGENT_DIR;
+// Inherited by every `claude --print` child: scripts/collective/hook-runner.mjs
+// classifies those sessions as "daemon" (presence kind; no identity primer).
+process.env.MAESTRO_DAEMON = "1";
 
 // ---------------------------------------------------------------------------
 // 0. Environment — BEFORE anything reads a credential

package/scripts/daemon/prompt-builder.mjs

@@ -12,6 +12,7 @@ import { wrapExternalContent } from "../../lib/security/external-content.mjs";
 import { isEnabled as orgEnabled } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
 import { outcomeSourceShareable } from "./session-outcomes.mjs";
+import { withParallelism } from "../../lib/prompts/parallelism.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 
@@ -852,16 +853,23 @@ export async function buildPrompt(item, classResult, options = {}) {
   const parts = [];
 
   // 1. Persona block (cached) — rendered from config/agent.json, which the
-  // Cohort enrollment pull keeps current. Leads the prompt and outranks the
+  // Cohort enrollment pull keeps current. Leads the BODY and outranks the
   // CLAUDE.md preamble below, because a scaffolded CLAUDE.md carries
   // "identity not yet configured" placeholder prose that would otherwise
   // contradict a perfectly good org record.
+  //
+  // THE PRECEDENCE SENTENCE NAMES ITSELF, NOT A POSITION. It used to say "the
+  // section above … anything below", which was true only while the persona was
+  // the first thing in the prompt. The parallelism directive is prepended at
+  // the end of this function (§10) and now leads, so "above" had two candidate
+  // referents and the directive sat outside the rule entirely — above it, not
+  // below. A self-naming sentence stays true wherever the block ends up.
   const persona = loadPersona();
   if (persona) {
     parts.push(persona);
     parts.push("");
     parts.push(
-      "The section above is your identity, resolved from your organisation's record of you. Where anything below conflicts with it, the section above wins.",
+      "This section is your identity, resolved from your organisation's record of you. Where anything else in this prompt conflicts with it, this section wins.",
     );
     parts.push("");
   }
@@ -1025,5 +1033,13 @@ export async function buildPrompt(item, classResult, options = {}) {
   // 9. Audit instruction
   parts.push(`Log all actions taken to logs/audit/${date}-actions.jsonl as a JSON line with: timestamp, action_type, target, result, session context.`);
 
-  return parts.join("\n");
+  // 10. The parallelism directive (WP-M7 mechanic 5). Every prompt this builder
+  // produces is handed to a sub-session that may plan and dispatch work of its
+  // own, and nothing else in the prompt ever says that fanning out is allowed —
+  // which is why sessions handed six independent tasks ran them one at a time.
+  // It LEADS the prompt because it governs how the session plans, before it has
+  // read a word of the item. `withParallelism` is idempotent, so a prompt that
+  // already carries it (composed by a caller, or handed on to `session spawn`,
+  // which applies the same seam) is returned with exactly one copy.
+  return withParallelism(parts.join("\n"));
 }

package/scripts/daemon/responder.mjs

@@ -10,14 +10,12 @@
  * 2. ACKNOWLEDGEMENTS: for complex items that need a full session, an immediate
  *    holding message so the sender knows the work has started.
  *
- *    THIS ONE USED TO SPAWN A MODEL TOO, AND THAT WAS THE BUG. A cold
- *    `claude --print` child under a 60-second cap, on a machine at 95-99%
- *    memory, to compose two sentences of courtesy: it lost that race 20 times
- *    in 32, and each loss was caught, logged as `holding_message_error`, and
- *    told the requester nothing while a 15-45 minute session ran behind a
- *    typing indicator. It is now composed by assurance.composeAck — a string
- *    concat and one HTTP call, which cannot time out, cannot be starved of
- *    memory, and cannot be refused by a spend cap.
+ *    This one is generated by assurance.generateAck — one bespoke haiku line
+ *    under a tight (~5s) cap — and on ANY generation failure it sends NOTHING.
+ *    That is a deliberate inversion (CEO directive 2026-08-30) of the previous
+ *    canned rotation ("On it." / "Looking now."), which itself replaced a 60s
+ *    model spawn that lost its race 20 times in 32. The failure budget is now
+ *    owned by the assurance sweep, not by boilerplate.
  *
  * Migrated off `@anthropic-ai/sdk` per CEO directive (Slack DM
  * D099N1JGKRQ, 2026-04-27 09:38Z + 11:33Z): all agent daemon model
@@ -56,10 +54,11 @@ import { rungById } from "../../lib/execution/route.mjs";
 // the property the acknowledgement path needed and did not have.
 import { deliver, deliverWithRetry, resolveSlackChannel } from "./deliver.mjs";
 import { startTyping, stopTyping } from "./typing-registry.mjs";
-// The acknowledgement is now COMPOSED, not generated. See assurance.mjs for why
-// (in short: a 60s `claude --print` spawn to write "let me look into it" lost
-// its own race 2 times in 3, and lost it silently).
-import { composeAck } from "./assurance.mjs";
+// The acknowledgement is GENERATED again — one bespoke haiku line under a
+// ~5s cap — but with the failure mode inverted from the old 60s-spawn era:
+// generation failure now means SILENCE (send nothing), never a canned
+// placeholder. CEO directive 2026-08-30; see assurance.generateAck.
+import { generateAck } from "./assurance.mjs";
 // Shared message-craft doctrine (distil by default; format only when the message
 // must be large; attach genuinely verbose content rather than dumping it). The
 // SAME constant leads the full-session prompt in prompt-builder.mjs, so a reactive
@@ -695,11 +694,10 @@ export function setGenerateResponseForTests(fn) {
  * Generate an ANSWER. Only an answer.
  *
  * This used to take an `isHolding` flag and, when set, spend a model call
- * writing an acknowledgement. That branch is gone: acknowledgements are
- * composed (assurance.composeAck), and the flag is deliberately not kept "just
- * in case", because keeping it is how it comes back. The one thing a model was
- * adding to a courtesy sentence was phrasing variety, at a cost of 13-46
- * seconds when it worked and total silence when it did not.
+ * writing an acknowledgement. That branch stays gone: acknowledgements live in
+ * assurance.generateAck (their own model, cap and silence-on-failure rules),
+ * and the flag is deliberately not kept "just in case", because keeping it is
+ * how it comes back.
  */
 async function realGenerateResponse(item, classResult) {
   const preamble = loadPreamble();
@@ -975,26 +973,29 @@ export async function sendQuickResponse(item, classResult, routed = null) {
  * Acknowledge an ask that is about to become a long-running session, and return
  * the text so the session's own prompt can see what the human was already told.
  *
- * THIS NO LONGER CALLS A MODEL, AND THAT IS THE WHOLE POINT.
+ * THE ACK IS GENERATED AGAIN — WITH THE FAILURE MODE INVERTED.
  *
- * It used to. `_generateResponse(item, classResult, true)` spawned a cold
- * `claude --print` child under a 60-second hard cap to compose two sentences of
- * courtesy. On a box at 95-99% memory that spawn lost its race 20 times in 32;
- * every loss threw, was caught below, logged as `holding_message_error`, and
- * told the requester nothing at all — while a session ran for a median of 14.7
- * minutes behind a typing indicator the human reads as "she's replying".
+ * History, because this path has now swung twice and the reasons matter:
  *
- * Generation was never needed here. An acknowledgement has a fixed shape, and
- * the one genuinely useful variable in it — what the ask is about — was already
- * computed by the classifier and sitting in `classResult.summary`. So the text
- * is composed (assurance.composeAck) and handed straight to transport. The path
- * is now a string concat plus one HTTP call: it cannot time out, cannot be
- * starved of memory, and cannot be refused by a spend cap.
+ *   1. Originally `_generateResponse(item, classResult, true)` spawned a cold
+ *      `claude --print` child under a 60-second cap. On a box at 95-99% memory
+ *      it lost that race 20 times in 32, and every loss was silent — the
+ *      requester got nothing while a 15-45 minute session ran behind a typing
+ *      indicator.
+ *   2. The fix made the ack a canned rotation (assurance.composeAck: "On it." /
+ *      "Looking now." / "On it — digging in now.") that could never fail.
+ *      It also could never sound like anyone. In the 08-2026 self-echo
+ *      incidents two agents traded those exact canned lines at each other, and
+ *      the CEO's verdict (2026-08-30) was that a reflex string is worse than
+ *      no ack at all.
  *
- * Failure is still possible (the network exists), and it is still not fatal —
- * but it is no longer FORGOTTEN. The caller opens an obligation before calling
- * this, and the assurance sweep retries any acknowledgement still undelivered
- * after ASSURANCE_ACK_GRACE_MS.
+ * So: assurance.generateAck produces ONE bespoke line from the actual thread
+ * via the cheapest model under a tight (~5s, env-tunable) cap, and on ANY
+ * generation failure this function sends NOTHING and says so in the log. The
+ * durability story is unchanged — the caller opened the obligation before
+ * calling this, the assurance sweep retries generation once within
+ * ASSURANCE_ACK_GRACE_MS, and the progress/failure notices still guarantee the
+ * human is never left in long-term silence.
  *
  * @returns {{ sent: boolean, holdingText: string|null }} result
  */
@@ -1002,8 +1003,8 @@ export async function sendHoldingMessage(item, classResult) {
   const startTime = Date.now();
 
   try {
-    const text = composeAck(item, classResult);
-
+    // Channel + dedup gates FIRST — they are free, and a model call spent on a
+    // message the dedup registry would refuse anyway is a pure waste.
     if (item.service === "slack") {
       const channel = resolveSlackChannel(item);
       if (!channel) {
@@ -1020,9 +1021,19 @@ export async function sendHoldingMessage(item, classResult) {
       }
     }
 
-    // Bounded retry on the SEND (not on any generation — there isn't any). A
-    // courtesy message that gives up on one dropped socket is how silence
-    // happens; ~3 seconds of retry in front of a waiting human is proportionate.
+    const text = await generateAck(item, classResult);
+    if (text == null) {
+      // Deliberate silence — never a canned fallback. The obligation the caller
+      // opened stays un-acked; the assurance sweep owns the (bounded) retry.
+      console.warn(`[responder] holding ack generation failed for ${item.sender} — sending nothing (silence over boilerplate, by design)`);
+      logResponse({ type: "holding_ack_generation_failed", sender: item.sender, service: item.service });
+      counters.bump("send.blocked", { stage: "ack_generation", service: item.service || "unknown", kind: "holding" });
+      return { sent: false, holdingText: null, error: "ack_generation_failed", genFailed: true };
+    }
+
+    // Bounded retry on the SEND. A courtesy message that gives up on one
+    // dropped socket is how silence happens; ~3 seconds of retry in front of a
+    // waiting human is proportionate.
     const delivered = await deliverWithRetry(item, text, { kind: "ack" });
     const sendResult = {
       sent: delivered.sent,
@@ -1053,7 +1064,7 @@ export async function sendHoldingMessage(item, classResult) {
       service: item.service,
       duration_ms: duration,
       text_length: text.length,
-      generated: false,
+      generated: true,
       attempts: delivered.attempts || 1,
       ...sendResult,
     });

package/scripts/daemon/sdk-version.mjs

@@ -0,0 +1,51 @@
+/**
+ * scripts/daemon/sdk-version.mjs — which SDK version is the code THIS daemon
+ * process is running?
+ *
+ * The daemon runs from the agent dir's COPIED scripts/daemon, not from
+ * node_modules. autoupdate installs the next version into node_modules first
+ * and merges the files a minute or two later; a daemon that (re)starts inside
+ * that window would report the node_modules version while executing the old
+ * copies, and `maestro upgrade --verify` would go green on a lie. So the
+ * order of trust is the version of the COPIED tree first:
+ *
+ *   1. .maestro/shipped-manifest.json `sdkVersion` — written by the upgrade
+ *      that copied the files (2.12+), i.e. the version of scripts/daemon/*;
+ *   2. node_modules/@cohortapp/agent-sdk/package.json — a pre-2.12 manifest
+ *      has no sdkVersion; the window above is then the only inaccuracy left;
+ *   3. the package this file itself ships in (a framework checkout).
+ *
+ * Read once at daemon start, never again (the dashboard must say what the
+ * process IS, not what node_modules became meanwhile).
+ *
+ * @module scripts/daemon/sdk-version
+ */
+
+"use strict";
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export const SDK_PACKAGE = "@cohortapp/agent-sdk";
+
+/**
+ * Pure over an injected reader. `readJson(path)` returns the parsed file or
+ * throws / returns null; every source is fail-open.
+ * @param {{agentDir:string, ownPackagePath?:string, readJson?:(p:string)=>any}} o
+ * @returns {{version:string, source:"manifest"|"node_modules"|"package"|"none"}}
+ */
+export function resolveRunningSdkVersion(o = {}) {
+  const readJson = o.readJson || ((p) => JSON.parse(readFileSync(p, "utf8")));
+  const tryRead = (p) => { try { return readJson(p); } catch { return null; /* absent/corrupt → next source */ } };
+  const manifest = tryRead(join(o.agentDir, ".maestro", "shipped-manifest.json"));
+  if (manifest && typeof manifest.sdkVersion === "string" && manifest.sdkVersion) return { version: manifest.sdkVersion, source: "manifest" };
+  const dep = tryRead(join(o.agentDir, "node_modules", ...SDK_PACKAGE.split("/"), "package.json"));
+  if (dep && dep.name === SDK_PACKAGE && typeof dep.version === "string") return { version: dep.version, source: "node_modules" };
+  if (o.ownPackagePath) {
+    const own = tryRead(o.ownPackagePath);
+    if (own && own.name === SDK_PACKAGE && typeof own.version === "string") return { version: own.version, source: "package" };
+  }
+  return { version: "", source: "none" };
+}
+
+export default { resolveRunningSdkVersion, SDK_PACKAGE };

package/scripts/daemon/sdk-version.test.mjs

@@ -0,0 +1,31 @@
+/**
+ * sdk-version.test.mjs — the daemon's own-version resolution prefers the
+ * version of the COPIED tree (the manifest) over node_modules.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { resolveRunningSdkVersion, SDK_PACKAGE } from "./sdk-version.mjs";
+
+function reader(files) {
+  return (p) => { if (p in files) return files[p]; throw new Error(`ENOENT ${p}`); };
+}
+const A = "/seat/ivy-ai";
+const MANIFEST = `${A}/.maestro/shipped-manifest.json`;
+const DEP = `${A}/node_modules/@cohortapp/agent-sdk/package.json`;
+const OWN = "/sdk/package.json";
+
+test("the manifest's sdkVersion wins: node_modules may already hold the NEXT version while the copied scripts are still the old one", () => {
+  const r = resolveRunningSdkVersion({ agentDir: A, ownPackagePath: OWN, readJson: reader({
+    [MANIFEST]: { version: 1, sdkVersion: "2.11.17" },
+    [DEP]: { name: SDK_PACKAGE, version: "2.12.0" },
+  }) });
+  assert.deepEqual(r, { version: "2.11.17", source: "manifest" });
+});
+
+test("a pre-2.12 manifest (no sdkVersion) or none → node_modules; then the package this file ships in; then empty", () => {
+  assert.deepEqual(resolveRunningSdkVersion({ agentDir: A, readJson: reader({ [MANIFEST]: { version: 1, files: [] }, [DEP]: { name: SDK_PACKAGE, version: "2.11.15" } }) }), { version: "2.11.15", source: "node_modules" });
+  assert.deepEqual(resolveRunningSdkVersion({ agentDir: A, ownPackagePath: OWN, readJson: reader({ [OWN]: { name: SDK_PACKAGE, version: "2.12.0" } }) }), { version: "2.12.0", source: "package" });
+  assert.deepEqual(resolveRunningSdkVersion({ agentDir: A, ownPackagePath: OWN, readJson: reader({ [OWN]: { name: "ivy-ai", version: "1.0.0" } }) }), { version: "", source: "none" }, "an agent's own package.json is not the SDK");
+  assert.deepEqual(resolveRunningSdkVersion({ agentDir: A, readJson: () => { throw new Error("EACCES"); } }), { version: "", source: "none" }, "fail-open");
+});

package/scripts/hooks/pre-send-audit.sh

@@ -6,10 +6,20 @@
 # recipient allowlist sanity check, and enforces hourly + daily rate caps.
 #
 # Usage: pre-send-audit.sh <channel_type>
-#   channel_type: slack | slack-draft | gmail | whatsapp
+#   channel_type: slack | slack-draft | gmail | whatsapp | cohort
+#
+# `cohort` is the PreToolUse channel `maestro global-setup` wires into
+# ~/.claude/settings.json for EVERY mcp__cohort outbound tool (messaging_send,
+# messaging_send_voice_note, email_send, email_draft_send, org_rpc) — the
+# persona gate below (section a2) is what the front-door session relies on to
+# never expose its own machinery to a human (design spec 2026-09-08 §3.6). The
+# same patterns run in-process in lib/comms/send-gate.mjs (screenPersona) for
+# the lanes no hook fronts: `maestro inbox reply`, the daemon's delivery, the
+# adapters. Keep the two lists in sync.
 #
 # Stdin: Claude Code PreToolUse JSON payload:
-#   { "tool_name": "...", "tool_input": { "text"|"message"|"body": "...",
+#   { "tool_name": "...", "tool_input": { "text"|"message"|"body"|"bodyText": "...",
+#     "subject": "...", "params": { …an org_rpc body… },
 #     "to"|"recipient"|"channel": "..." }, ... }
 #
 # Exit codes:
@@ -33,7 +43,7 @@ deny() {
 }
 
 CHANNEL_TYPE="${1:-}"
-[ -n "$CHANNEL_TYPE" ] || deny "Channel type required (slack|slack-draft|gmail|whatsapp)"
+[ -n "$CHANNEL_TYPE" ] || deny "Channel type required (slack|slack-draft|gmail|whatsapp|cohort)"
 
 # jq is mandatory — without it we cannot inspect content, so refuse to send.
 command -v jq >/dev/null 2>&1 || deny "jq not available — cannot screen outbound content (fail closed)"
@@ -50,15 +60,20 @@ fi
 # Extract the outbound text. Claude Code wraps the tool args under
 # tool_input; for robustness we also look at the top level. We concatenate
 # every plausible content field so a banned phrase anywhere is caught.
+# `params` is where org_rpc carries an outbound body; `bodyText`/`subject` are
+# the mail-desk (email_draft_send / email_send) content fields.
 CONTENT=$(printf '%s' "$TOOL_INPUT" | jq -r '
-    [ .tool_input // {} , . ]
+    [ .tool_input // {} , ( .tool_input.params? | if type=="object" then . else {} end ) , . ]
     | map(
         ( .text? // empty ),
         ( .message? // empty ),
         ( .body? // empty ),
+        ( .bodyText? // empty ),
+        ( .subject? // empty ),
         ( .content? // empty ),
         ( .blocks? | if type=="array" or type=="object" then tojson else empty end )
       )
+    | map(if type=="string" then . else tojson end)
     | flatten
     | map(select(. != null and . != ""))
     | join("\n")
@@ -110,6 +125,84 @@ if printf '%s' "$CONTENT" | grep -Eiq '(^|[[:cntrl:]])[[:space:]]*(Certainly!|Ab
     deny "Banned filler opener (Certainly!/Absolutely!/Great question!) — see policies/communication-style.md"
 fi
 
+# --- (a2) persona-leak screen ----------------------------------------------
+# The agent is one persona to the humans it talks to; parallel sessions,
+# sub-sessions, subagents and workflows are internal workings. Outbound text
+# may not name them, and may not name Claude Code / a language model. The
+# denial carries the offending phrase so the session rewrites in its own voice
+# ("my team", "a colleague", "one of my analysts").
+#
+# Patterns are case-insensitive extended regexes. "subagent"/"sub-agent" is
+# blocked only when it is followed by said|reported|session — the bare noun in
+# an internal-process sentence is tolerated, the attribution of speech to a
+# machine part is not.
+PERSONA_PATTERNS=(
+    'claude[[:space:]]+code'
+    'claude[[:space:]]+sessions?'
+    'sub-sessions?'
+    'sub-?agents?[[:space:]]+(said|reported|sessions?)'
+    'workflow[[:space:]]+agents?'
+    'as[[:space:]]+an[[:space:]]+ai\b'
+    'language[[:space:]]+model'
+)
+for pat in "${PERSONA_PATTERNS[@]}"; do
+    hit=$(printf '%s' "$CONTENT" | grep -Eio -- "$pat" 2>/dev/null | head -n 1) || true
+    if [ -n "$hit" ]; then
+        deny "Persona leak in outbound message: \"$hit\" — rewrite in your own voice (my team / a colleague), never name the machinery"
+    fi
+done
+
+# Session names are internal identifiers and must never reach a human — but
+# the rule is BOUNDED, not guessed: `<first>-main` is always internal; any
+# other name is internal only when it is a registered peer
+# ($AGENT_ROOT/state/session/peers.json, written by `maestro session spawn`,
+# an array or {peers:[…]} of {name,…}) or listed in MAESTRO_SESSION_NAMES
+# (comma-separated). A colleague called Marc-Antoine, the slug james-kirkland
+# in a URL or the mailbox ethan-miller@ are ordinary text.
+#
+# The first name resolves, in order, from MAESTRO_AGENT_FIRST,
+# $AGENT_ROOT/config/agent.json (firstName, else the first word of fullName)
+# and the machine pointer ~/.claude/maestro-agent.json (agentName). When none
+# resolves the `<first>-main` check is skipped — the phrase gate above still
+# applies — because a wrong guess would block legitimate text.
+FIRST="${MAESTRO_AGENT_FIRST:-}"
+if [ -z "$FIRST" ]; then
+    for cand in "${AGENT_ROOT:-}/config/agent.json" "${AGENT_DIR:-}/config/agent.json" "$HOME/.claude/maestro-agent.json"; do
+        [ -f "$cand" ] || continue
+        FIRST=$(jq -r '(.firstName // .agentName // .fullName // "") | tostring | split(" ")[0] | ascii_downcase' "$cand" 2>/dev/null) || FIRST=""
+        [ -n "$FIRST" ] && [ "$FIRST" != "null" ] && break
+        FIRST=""
+    done
+fi
+FIRST=$(printf '%s' "$FIRST" | tr '[:upper:]' '[:lower:]' | tr -cd 'a-z0-9-')
+
+SESSION_NAMES=()
+[ -n "$FIRST" ] && SESSION_NAMES+=("${FIRST}-main")
+for peers in "${AGENT_ROOT:-}/state/session/peers.json" "${AGENT_DIR:-}/state/session/peers.json"; do
+    [ -f "$peers" ] || continue
+    # A corrupt registry is an empty one: this must never fail the whole send closed.
+    while IFS= read -r pn; do
+        [ -n "$pn" ] && SESSION_NAMES+=("$pn")
+    done < <(jq -r '(if type=="array" then . elif type=="object" then (.peers // []) else [] end) | .[] | select(type=="object") | (.name // empty) | tostring | ascii_downcase' "$peers" 2>/dev/null || true)
+    break
+done
+if [ -n "${MAESTRO_SESSION_NAMES:-}" ]; then
+    IFS=',' read -r -a extra_names <<< "$MAESTRO_SESSION_NAMES"
+    # bash 3.2 (macOS) + set -u: an empty array expands as "unbound" — use the ${a[@]+"${a[@]}"} idiom.
+    for en in ${extra_names[@]+"${extra_names[@]}"}; do
+        en=$(printf '%s' "$en" | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]')
+        [ -n "$en" ] && SESSION_NAMES+=("$en")
+    done
+fi
+for sname in ${SESSION_NAMES[@]+"${SESSION_NAMES[@]}"}; do
+    sname_re=$(printf '%s' "$sname" | sed 's/[.[\*^$()+?{|]/\\&/g')
+    # Word-bounded on [A-Za-z0-9_-]: "alex-main" hits, "alex-mainland" / "alex-main-street" do not.
+    name_hit=$(printf '%s' "$CONTENT" | grep -Eio -- "(^|[^[:alnum:]_-])${sname_re}([^[:alnum:]_-]|$)" 2>/dev/null | head -n 1 | sed -E 's/^[^[:alnum:]_-]//; s/[^[:alnum:]_-]$//') || true
+    if [ -n "$name_hit" ]; then
+        deny "Persona leak in outbound message: \"$name_hit\" is an internal session name — say \"my team\" or \"a colleague\" instead"
+    fi
+done
+
 # --- (b) recipient allowlist sanity check ----------------------------------
 # Only enforced when a recipient is present AND an allowlist file exists.
 # Allowlist file: one entry (channel id, email, handle) per line, '#' comments.