@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/lib/comms/send-gate.test.mjs

@@ -1,770 +0,0 @@
-/**
- * Tests for lib/comms/send-gate.mjs — the shared outbound send-gate chokepoint.
- *
- * Covers (gaps-product-quality P0-3):
- *   - every banned phrase / AI-tell opener blocks
- *   - AI-disclosure: a concealed first-contact message under a disclose-always
- *     posture blocks; a denial-of-AI ("I'm not a bot") blocks under any posture
- *   - information-barrier wall blocks a walled topic to a matching recipient
- *   - benign internal + external messages pass
- *   - unreadable policy fails CLOSED for external, OPEN for internal
- *   - recipient allowlist (opt-in)
- *
- * The filesystem reader is injected so every branch (including "unreadable
- * policy") is driven without touching disk.
- *
- * @module lib/comms/send-gate.test
- */
-
-import { describe, it } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import {
-  screenOutbound,
-  screenBannedPhrases,
-  screenPersona,
-  screenDisclosure,
-  screenBarriers,
-  screenAllowlist,
-  classifyRecipient,
-  BANNED_SUBSTRINGS,
-  BANNED_OPENERS,
-} from "./send-gate.mjs";
-
-/* ─── fixtures ─────────────────────────────────────────────────────────────
- * A minimal but realistic ai-disclosure.yaml and information-barriers.yaml.
- * The disclosure file mirrors the real one's resolution semantics: EU →
- * disclose-always, default → disclose-always, internal-style on-ask posture
- * available for non-first-contact testing.
- */
-
-const DISCLOSURE_YAML = `
-version: 1
-invariant:
-  answer_truthfully_if_asked: true
-posture:
-  disclose-always:
-    proactive_disclosure: true
-    machine_readable_marking: true
-  disclose-on-ask:
-    proactive_disclosure: false
-    machine_readable_marking: true
-  concealed-where-legal:
-    proactive_disclosure: false
-    machine_readable_marking: false
-    requires_sign_off: true
-default_posture: disclose-always
-governance:
-  sign_off:
-    required_for: [concealed-where-legal]
-    approver: null
-    jurisdictions: []
-jurisdictions:
-  EU:
-    posture: disclose-always
-  US-CA:
-    posture: disclose-on-ask
-  US-NV:
-    posture: concealed-where-legal
-  default:
-    posture: disclose-always
-resolution:
-  unsigned_concealed_posture: disclose-always
-`;
-
-const BARRIERS_YAML = `
-domains:
-  financial:
-    default_sensitivity: high
-barriers:
-  - name: partner-wall
-    recipient_pattern: "@partnerco\\\\.com$"
-    blocked_topics:
-      - "cap table"
-      - "acquisition target"
-    reason: "PartnerCo must not see Northwind cap table / M&A pipeline"
-  - name: external-financials
-    recipient_class: external
-    blocked_topics:
-      - "runway"
-`;
-
-/** Build an injectable fs over an in-memory map of relPath → contents|null. */
-function memFs(files) {
-  return {
-    existsSync: (p) => {
-      for (const [rel, val] of Object.entries(files)) {
-        if (p.endsWith(rel)) return val !== null && val !== undefined;
-      }
-      return false;
-    },
-    readFileSync: (p) => {
-      for (const [rel, val] of Object.entries(files)) {
-        if (p.endsWith(rel)) {
-          if (val === null || val === undefined) {
-            const e = new Error("EACCES");
-            e.code = "EACCES";
-            throw e;
-          }
-          return val;
-        }
-      }
-      const e = new Error("ENOENT");
-      e.code = "ENOENT";
-      throw e;
-    },
-  };
-}
-
-const ROOT = "/repo";
-const GOOD_FILES = {
-  "policies/ai-disclosure.yaml": DISCLOSURE_YAML,
-  "policies/information-barriers.yaml": BARRIERS_YAML,
-};
-
-/* ─── banned phrases ───────────────────────────────────────────────────────*/
-
-describe("screenBannedPhrases", () => {
-  for (const phrase of BANNED_SUBSTRINGS) {
-    it(`blocks banned substring: ${phrase}`, () => {
-      const reason = screenBannedPhrases(`Hi there. ${phrase} so let's go.`);
-      assert.ok(reason, `expected a block for "${phrase}"`);
-      assert.match(reason, /banned AI-tell phrase/);
-    });
-  }
-
-  for (const opener of BANNED_OPENERS) {
-    it(`blocks banned opener at message start: ${opener}`, () => {
-      const reason = screenBannedPhrases(`${opener} Here we go.`);
-      assert.ok(reason);
-      assert.match(reason, /banned filler opener/);
-    });
-    it(`blocks banned opener at line start: ${opener}`, () => {
-      const reason = screenBannedPhrases(`First line.\n${opener} second.`);
-      assert.ok(reason);
-    });
-  }
-
-  it("allows benign prose with no AI-tells", () => {
-    assert.equal(screenBannedPhrases("In progress — only blocker is DBA approval."), null);
-  });
-
-  it("does not block 'absolutely' mid-sentence (opener-only rule)", () => {
-    assert.equal(screenBannedPhrases("That is absolutely the right call."), null);
-  });
-
-  it("is case-insensitive", () => {
-    assert.ok(screenBannedPhrases("AS AN AI, I cannot do that."));
-  });
-});
-
-/* ─── end-to-end: banned phrase blocks via screenOutbound ──────────────────*/
-
-describe("screenOutbound — banned phrases", () => {
-  it("blocks a message containing a banned phrase (external)", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "graham@kpm.com",
-      text: "I'd be happy to set up a call.",
-      agentRoot: ROOT,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /banned AI-tell phrase/);
-  });
-
-  it("blocks banned phrase even for internal recipients", async () => {
-    const res = await screenOutbound({
-      channel: "slack",
-      recipient: "C0123456",
-      text: "As an AI, I think we should ship.",
-      agentRoot: ROOT,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, false);
-  });
-});
-
-/* ─── disclosure ───────────────────────────────────────────────────────────*/
-
-describe("screenDisclosure (unit)", () => {
-  const policy = {
-    posture: {
-      "disclose-always": { proactive_disclosure: true },
-      "disclose-on-ask": { proactive_disclosure: false },
-    },
-    default_posture: "disclose-always",
-    jurisdictions: { EU: { posture: "disclose-always" }, "US-CA": { posture: "disclose-on-ask" }, default: { posture: "disclose-always" } },
-  };
-
-  it("blocks a concealed first-contact message under disclose-always", () => {
-    const r = screenDisclosure("Hi, can we move the meeting to 3pm?", {
-      policy,
-      jurisdiction: "EU",
-      firstContact: true,
-    });
-    assert.ok(r);
-    assert.match(r, /proactive disclosure/);
-  });
-
-  it("allows a first-contact message that discloses AI nature", () => {
-    const r = screenDisclosure(
-      "Hi — I'm an AI assistant working on behalf of Alex. Can we move to 3pm?",
-      { policy, jurisdiction: "EU", firstContact: true },
-    );
-    assert.equal(r, null);
-  });
-
-  it("does not require disclosure on a non-first-contact reply", () => {
-    const r = screenDisclosure("Sounds good, 3pm works.", {
-      policy,
-      jurisdiction: "EU",
-      firstContact: false,
-    });
-    assert.equal(r, null);
-  });
-
-  it("does not require proactive disclosure under disclose-on-ask", () => {
-    const r = screenDisclosure("Sure, let's do 3pm.", {
-      policy,
-      jurisdiction: "US-CA",
-      firstContact: true,
-    });
-    assert.equal(r, null);
-  });
-
-  it("blocks an explicit denial of AI nature under ANY posture (invariant)", () => {
-    const r = screenDisclosure("No, I'm not a bot, I'm a real person.", {
-      policy,
-      jurisdiction: "US-CA", // even the on-ask posture cannot relax the invariant
-      firstContact: false,
-    });
-    assert.ok(r);
-    assert.match(r, /invariant/);
-  });
-
-  it("blocks denial even with no policy loaded (embedded invariant list)", () => {
-    const r = screenDisclosure("I am not an AI.", { policy: null });
-    assert.ok(r);
-  });
-
-  it("collapses unsigned concealed-where-legal to disclose-always", () => {
-    const concealedPolicy = {
-      posture: {
-        "disclose-always": { proactive_disclosure: true },
-        "concealed-where-legal": { proactive_disclosure: false },
-      },
-      default_posture: "disclose-always",
-      governance: { sign_off: { approver: null, jurisdictions: [] } },
-      jurisdictions: { "US-NV": { posture: "concealed-where-legal" } },
-    };
-    const r = screenDisclosure("Hi, moving the meeting to 3pm.", {
-      policy: concealedPolicy,
-      jurisdiction: "US-NV",
-      firstContact: true,
-    });
-    assert.ok(r, "unsigned concealed posture must fail safe to disclose-always");
-  });
-});
-
-describe("screenOutbound — disclosure", () => {
-  it("blocks a concealed first-contact external EU message", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "client@example.eu",
-      text: "Following up on the contract — can we sign Friday?",
-      agentRoot: ROOT,
-      jurisdiction: "EU",
-      firstContact: true,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /disclosure/i);
-  });
-
-  it("blocks a denial of AI nature regardless of jurisdiction", async () => {
-    const res = await screenOutbound({
-      channel: "whatsapp",
-      recipient: "+15551234567",
-      text: "Haha no, I'm a real person, not a bot.",
-      agentRoot: ROOT,
-      jurisdiction: "US-CA",
-      firstContact: false,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /invariant/);
-  });
-});
-
-/* ─── information barriers ─────────────────────────────────────────────────*/
-
-describe("screenBarriers (unit)", () => {
-  let policy;
-  it("loads the barriers fixture for unit checks", async () => {
-    const yaml = (await import("js-yaml")).default;
-    policy = yaml.load(BARRIERS_YAML);
-    assert.ok(Array.isArray(policy.barriers));
-  });
-
-  it("blocks a walled topic to a pattern-matched recipient", () => {
-    const r = screenBarriers("Here's the latest cap table figures.", {
-      policy,
-      recipient: "deals@partnerco.com",
-      recipientClass: "external",
-    });
-    assert.ok(r);
-    assert.match(r, /information barrier/);
-  });
-
-  it("allows a non-walled topic to the same recipient", () => {
-    const r = screenBarriers("Confirming the JV ops sync at 10am.", {
-      policy,
-      recipient: "deals@partnerco.com",
-      recipientClass: "external",
-    });
-    assert.equal(r, null);
-  });
-
-  it("blocks a recipient_class wall (runway → any external)", () => {
-    const r = screenBarriers("Our runway is 14 months.", {
-      policy,
-      recipient: "investor@somefund.com",
-      recipientClass: "external",
-    });
-    assert.ok(r);
-  });
-
-  it("does not apply a recipient_class wall to internal recipients", () => {
-    const r = screenBarriers("Our runway is 14 months.", {
-      policy,
-      recipient: "C0123456",
-      recipientClass: "internal",
-    });
-    assert.equal(r, null);
-  });
-
-  it("is a no-op when no barriers section is present", () => {
-    const r = screenBarriers("anything at all cap table runway", {
-      policy: { domains: {} },
-      recipient: "x@y.com",
-      recipientClass: "external",
-    });
-    assert.equal(r, null);
-  });
-});
-
-describe("screenOutbound — barriers", () => {
-  it("blocks a walled topic to a walled recipient end-to-end", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "deals@partnerco.com",
-      // Discloses AI to pass the disclosure gate; barrier is what trips.
-      text: "Writing as the AI assistant for Alex — here's our cap table.",
-      agentRoot: ROOT,
-      jurisdiction: "default",
-      firstContact: true,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /information barrier/);
-  });
-});
-
-/* ─── allowlist ────────────────────────────────────────────────────────────*/
-
-describe("screenAllowlist", () => {
-  it("is a no-op when not configured", () => {
-    assert.equal(screenAllowlist("x@y.com", undefined), null);
-    assert.equal(screenAllowlist("x@y.com", []), null);
-  });
-  it("allows a recipient on the list", () => {
-    assert.equal(screenAllowlist("x@y.com", ["x@y.com", "z@y.com"]), null);
-  });
-  it("blocks a recipient not on the list", () => {
-    const r = screenAllowlist("intruder@evil.com", ["x@y.com"]);
-    assert.ok(r);
-    assert.match(r, /not on the configured send allowlist/);
-  });
-});
-
-describe("screenOutbound — allowlist", () => {
-  it("blocks an off-allowlist recipient", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "intruder@evil.com",
-      text: "Writing as the AI assistant for Alex — quick question.",
-      agentRoot: ROOT,
-      jurisdiction: "default",
-      allowlist: ["client@example.eu"],
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /allowlist/);
-  });
-});
-
-/* ─── benign passes ────────────────────────────────────────────────────────*/
-
-describe("screenOutbound — benign", () => {
-  it("passes a benign internal Slack reply", async () => {
-    const res = await screenOutbound({
-      channel: "slack",
-      recipient: "C0123456",
-      text: "In progress — only blocker is DBA approval, expected by EOD.",
-      agentRoot: ROOT,
-      firstContact: false,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, true, res.reason);
-  });
-
-  it("passes a benign external email that discloses AI on first contact", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "client@example.eu",
-      text: "Writing as the AI assistant for Alex — can we sign the contract Friday?",
-      agentRoot: ROOT,
-      jurisdiction: "EU",
-      firstContact: true,
-      fs: memFs(GOOD_FILES),
-    });
-    assert.equal(res.allow, true, res.reason);
-  });
-});
-
-/* ─── fail posture ─────────────────────────────────────────────────────────*/
-
-describe("screenOutbound — fail posture (unreadable policy)", () => {
-  it("fails CLOSED for an external recipient when ai-disclosure.yaml is unreadable", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "client@example.eu", // external
-      text: "Writing as the AI assistant for Alex — quick note.",
-      agentRoot: ROOT,
-      jurisdiction: "default",
-      firstContact: true,
-      fs: memFs({
-        "policies/ai-disclosure.yaml": null, // unreadable (EACCES)
-        "policies/information-barriers.yaml": BARRIERS_YAML,
-      }),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /unreadable.*external|failing closed/i);
-  });
-
-  it("fails CLOSED for external when information-barriers.yaml is unreadable", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "client@example.eu",
-      text: "Writing as the AI assistant for Alex — quick note.",
-      agentRoot: ROOT,
-      jurisdiction: "default",
-      firstContact: true,
-      fs: memFs({
-        "policies/ai-disclosure.yaml": DISCLOSURE_YAML,
-        "policies/information-barriers.yaml": null, // unreadable
-      }),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /unreadable|failing closed/i);
-  });
-
-  it("fails OPEN for an internal recipient when a policy file is unreadable", async () => {
-    const res = await screenOutbound({
-      channel: "slack",
-      recipient: "C0123456", // internal Slack id
-      text: "Heads up — deploy is going out at 4pm.",
-      agentRoot: ROOT,
-      firstContact: false,
-      fs: memFs({
-        "policies/ai-disclosure.yaml": null,
-        "policies/information-barriers.yaml": null,
-      }),
-    });
-    assert.equal(res.allow, true, res.reason);
-  });
-
-  it("fails CLOSED for external when disclosure YAML is malformed", async () => {
-    const res = await screenOutbound({
-      channel: "email",
-      recipient: "client@example.eu",
-      text: "Writing as the AI assistant for Alex — quick note.",
-      agentRoot: ROOT,
-      jurisdiction: "default",
-      firstContact: true,
-      fs: memFs({
-        "policies/ai-disclosure.yaml": "{[ this is : not valid yaml :::",
-        "policies/information-barriers.yaml": BARRIERS_YAML,
-      }),
-    });
-    assert.equal(res.allow, false);
-  });
-
-  it("still blocks a banned phrase even when policy files are missing (embedded SoT)", async () => {
-    // Internal recipient + missing files would otherwise fail-open; the banned
-    // phrase screen runs first off the embedded constant list, so it still trips.
-    const res = await screenOutbound({
-      channel: "slack",
-      recipient: "C0123456",
-      text: "As an AI I will help.",
-      agentRoot: ROOT,
-      fs: memFs({}),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /banned/);
-  });
-});
-
-/* ─── recipient classification ─────────────────────────────────────────────*/
-
-describe("classifyRecipient", () => {
-  it("classifies Slack channel/DM ids as internal", () => {
-    assert.equal(classifyRecipient("slack", "C0123456"), "internal");
-    assert.equal(classifyRecipient("slack", "D0ABCDEFG"), "internal");
-    assert.equal(classifyRecipient("slack", "U0ABCDEFG"), "internal");
-  });
-  it("classifies Telegram numeric chat ids as internal", () => {
-    assert.equal(classifyRecipient("telegram", "123456789"), "internal");
-    assert.equal(classifyRecipient("telegram", "-1001234567"), "internal");
-  });
-  it("classifies emails as external by default", () => {
-    assert.equal(classifyRecipient("email", "x@external.com"), "external");
-  });
-  it("classifies emails on internal domains as internal", () => {
-    assert.equal(
-      classifyRecipient("email", "alex@internal.example", ["internal.example"]),
-      "internal",
-    );
-    assert.equal(
-      classifyRecipient("email", "ops@eng.internal.example", ["internal.example"]),
-      "internal",
-    );
-  });
-  it("classifies phone numbers as external", () => {
-    assert.equal(classifyRecipient("whatsapp", "+15551234567"), "external");
-    assert.equal(classifyRecipient("sms", "+15551234567"), "external");
-  });
-  it("treats empty recipient as external (conservative)", () => {
-    assert.equal(classifyRecipient("email", ""), "external");
-  });
-
-  // REGRESSION — observed live, 2026-08-11, tracing a public-space thread reply
-  // end to end for a real seat. `sendMessage` screens every org post as
-  // {channel:"cohort", recipient:<channelId>}; with no `cohort` case the switch
-  // fell through and a cuid has no "@", so the agent's OWN #general channel
-  // classified EXTERNAL. That flipped `failPolicy` to fail-closed and the reply
-  // was refused with: outbound policy "policies/ai-disclosure.yaml" unreadable
-  // — failing closed for external recipient.
-  it("classifies Cohort channel/member ids as internal — the agent's own workspace", () => {
-    // The literal ids from the live trace.
-    assert.equal(classifyRecipient("cohort", "cmqs5i86p0008ta0129ql6rv9"), "internal"); // #general
-    assert.equal(classifyRecipient("cohort", "cmqh0tcml004ihhl6zev6ocb5"), "internal"); // a member (DM)
-    // lib/org/tool-surface.mjs spells the same surface "cohort-org".
-    assert.equal(classifyRecipient("cohort-org", "cms6vuxjw00a7mx01ljlyrluu"), "internal");
-    // uuid-shaped org ids too.
-    assert.equal(
-      classifyRecipient("cohort", "3f2504e0-4f89-11d3-9a0c-0305e82c3301"),
-      "internal",
-    );
-  });
-
-  // REGRESSION — the SAME defect one shape further on. `deliver.mjs` answers a
-  // roomless surface on its entity thread and addresses it `task:<id>` /
-  // `file:<id>` / `decision:<id>`. The colon fails COHORT_ID, so every board,
-  // doc and decision reply classified EXTERNAL — fail-CLOSED policy faults for
-  // the whole board lane, and `recipient_class: external` barrier rules applied
-  // to internal board chatter. The module printed its own warning about it on
-  // every process.
-  it("classifies Cohort ENTITY threads as internal — a board reply is not an outsider", () => {
-    assert.equal(classifyRecipient("cohort", "task:cmrlw2l3600e9hh8n10hprdrd"), "internal");
-    assert.equal(classifyRecipient("cohort", "file:cmsspqi9500dmo401gg51ntz7"), "internal");
-    assert.equal(classifyRecipient("cohort", "decision:cmdec0000000000000000000"), "internal");
-    // The chat-attachment fileKey is opaque, not cuid-shaped.
-    assert.equal(classifyRecipient("cohort", "file:fk_abc123"), "internal");
-    assert.equal(classifyRecipient("cohort-org", "task:cmrlw2l3600e9hh8n10hprdrd"), "internal");
-  });
-
-  it("the entity-ref prefix set is CLOSED — it is not a colon wildcard", () => {
-    // Otherwise "internal" becomes a thing anyone can claim by adding a colon.
-    assert.equal(classifyRecipient("cohort", "mailto:someone@external.com"), "external");
-    assert.equal(classifyRecipient("cohort", "approval:aprv_journey_msopegu4"), "external");
-    assert.equal(classifyRecipient("cohort", "task:"), "external");
-    assert.equal(classifyRecipient("cohort", "task:someone@external.com"), "external");
-  });
-
-  it("does NOT launder a genuinely external address arriving on the org channel", () => {
-    // The whole point of scoping the case to id-shaped recipients: an email or
-    // a phone number handed to an org surface must still be external, or the
-    // fix would open the AI-disclosure gate for real outsiders.
-    assert.equal(classifyRecipient("cohort", "someone@external.com"), "external");
-    assert.equal(classifyRecipient("cohort-org", "client@bank.example"), "external");
-    assert.equal(classifyRecipient("cohort", "+15551234567"), "external");
-    // …and an allow-listed internal domain still resolves through the domain test.
-    assert.equal(
-      classifyRecipient("cohort", "alex@internal.example", ["internal.example"]),
-      "internal",
-    );
-  });
-
-  it("an unreadable required policy no longer gags the agent in its own workspace", async () => {
-    // The end-to-end symptom, reduced: no policies/ on disk at all.
-    const emptyFs = { existsSync: () => false, readFileSync: () => { throw new Error("ENOENT"); } };
-    const org = await screenOutbound({
-      channel: "cohort",
-      recipient: "cmqs5i86p0008ta0129ql6rv9",
-      text: "Already voted espresso — I'm in the count.",
-      fs: emptyFs,
-    });
-    assert.equal(org.allow, true, `org post must fail OPEN, got: ${org.reason}`);
-
-    // The external posture is untouched — this is the half that must NOT regress.
-    const outsider = await screenOutbound({
-      channel: "email",
-      recipient: "someone@external.com",
-      text: "Already voted espresso — I'm in the count.",
-      fs: emptyFs,
-    });
-    assert.equal(outsider.allow, false);
-    assert.match(outsider.reason, /failing closed for external recipient/);
-  });
-});
-
-/* ─── real-disk integration smoke (uses the actual readPolicy path) ────────*/
-
-describe("screenOutbound — real-disk read path", () => {
-  it("reads policies from a real agentRoot and blocks a barrier", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "send-gate-"));
-    try {
-      mkdirSync(join(dir, "policies"), { recursive: true });
-      writeFileSync(join(dir, "policies", "ai-disclosure.yaml"), DISCLOSURE_YAML);
-      writeFileSync(join(dir, "policies", "information-barriers.yaml"), BARRIERS_YAML);
-      const res = await screenOutbound({
-        channel: "email",
-        recipient: "deals@partnerco.com",
-        text: "Writing as the AI assistant for Alex — our acquisition target list.",
-        agentRoot: dir,
-        jurisdiction: "default",
-        firstContact: true,
-      });
-      assert.equal(res.allow, false);
-      assert.match(res.reason, /information barrier/);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});
-
-/* ─── persona discipline (front-door session §3.6) ─────────────────────────
- * The agent is one persona to every human. The machinery — Claude Code, a
- * session, a sub-session, a subagent that "said", a workflow agent, the model,
- * an internal session name — never appears in outbound text. This screen runs
- * inside screenOutbound so EVERY lane gets it: the daemon's delivery
- * (`maestro inbox reply`), lib/org/messaging.sendMessage, the org MCP tools
- * (messaging_send, email_send, email_draft_send, org_rpc) and the adapters —
- * not only the PreToolUse shell hook.
- */
-
-describe("screenPersona (unit)", () => {
-  for (const [label, text] of [
-    ["Claude Code", "I'll have Claude Code pick that up this afternoon."],
-    ["Claude session", "A separate claude session is running the numbers."],
-    ["sub-session", "I kicked off a sub-session for the deck."],
-    ["subagent said", "The subagent said the deploy finished."],
-    ["sub-agent reported", "My sub-agent reported two blockers."],
-    ["subagent session", "The subagent session is still going."],
-    ["workflow agent", "The workflow agent will file the summary."],
-    ["language model", "Every language model has limits, mine included."],
-  ]) {
-    it(`blocks "${label}" and names the phrase`, () => {
-      const reason = screenPersona(text);
-      assert.ok(reason, `expected a block for "${label}"`);
-      assert.match(reason, /persona leak/i);
-      assert.match(reason.toLowerCase(), new RegExp(label.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/\s+/g, "\\s+")));
-    });
-  }
-
-  it("session names are BOUNDED: <first>-main always, other <first>-<x> only when registered as a peer", () => {
-    assert.ok(screenPersona("Check with alex-main for the latest.", { first: "alex" }));
-    assert.ok(screenPersona("Ask ALEX-MAIN.", { first: "alex" }), "case-insensitive");
-    assert.equal(screenPersona("alex-research has the draft ready.", { first: "alex" }), null, "unregistered peer name: not a session name");
-    assert.ok(screenPersona("alex-research has the draft ready.", { first: "alex", sessionNames: ["alex-research"] }));
-    assert.ok(screenPersona("alex-research has the draft ready.", { sessionNames: ["alex-research"] }), "names work without a first name");
-  });
-
-  it("does not block a colleague's hyphenated name, a URL slug or an email local part that starts with the first name", () => {
-    for (const [first, text] of [
-      ["marc", "Marc-Antoine confirmed the numbers."],
-      ["james", "See https://os.cohortapp.com/spaces/james-kirkland for the thread."],
-      ["ethan", "Loop in ethan-miller@example.com on the invoice."],
-      ["alex", "Alexandra-Maine sent the invoice."],
-      ["alex", "alex-mainland is the venue."],
-    ]) {
-      assert.equal(screenPersona(text, { first }), null, `"${text}" must pass for first=${first}`);
-    }
-  });
-
-  it("colleague phrasing, the bare noun 'subagents', and the calendar sense of 'session' all pass", () => {
-    for (const text of [
-      "One of my analysts is on it; I'll have the numbers by 3.",
-      "My team has the deck in review — sending the draft after lunch.",
-      "We use subagents internally for the heavy lifting.",
-      "The session on Thursday (the board session) starts at 9.",
-      "",
-    ]) {
-      assert.equal(screenPersona(text, { first: "alex" }), null, `"${text}" must pass`);
-    }
-    assert.equal(screenPersona(null), null);
-  });
-});
-
-describe("screenOutbound — persona", () => {
-  const PERSONA_FILES = {
-    ...GOOD_FILES,
-    "config/agent.json": JSON.stringify({ firstName: "Alex", fullName: "Alex Rivera" }),
-    "state/session/peers.json": JSON.stringify([{ name: "alex-deck", muxName: "maestro-alex-deck", purpose: "deck" }]),
-  };
-
-  it("blocks a persona leak for an internal Cohort recipient (the `maestro inbox reply` lane)", async () => {
-    const res = await screenOutbound({
-      channel: "cohort",
-      recipient: "clx0123456789abcdefghij",
-      text: "My sub-session is on it, check with alex-main.",
-      agentRoot: ROOT,
-      firstContact: false,
-      fs: memFs(PERSONA_FILES),
-    });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /persona leak/i);
-    assert.match(res.reason, /sub-session/i);
-  });
-
-  it("reads the first name from config/agent.json and the peer names from state/session/peers.json under agentRoot", async () => {
-    const fs = memFs(PERSONA_FILES);
-    const main = await screenOutbound({ channel: "cohort", recipient: "clx0123456789abcdefghij", text: "alex-main will chase it.", agentRoot: ROOT, firstContact: false, fs });
-    assert.equal(main.allow, false);
-    assert.match(main.reason, /alex-main/);
-    const peer = await screenOutbound({ channel: "cohort", recipient: "clx0123456789abcdefghij", text: "alex-deck has the slides.", agentRoot: ROOT, firstContact: false, fs });
-    assert.equal(peer.allow, false, "a registered peer name is a session name");
-    const other = await screenOutbound({ channel: "cohort", recipient: "clx0123456789abcdefghij", text: "alex-research is not a peer here.", agentRoot: ROOT, firstContact: false, fs });
-    assert.equal(other.allow, true, "an unregistered <first>-x is ordinary text");
-  });
-
-  it("explicit agentFirst / sessionNames override the disk read; no identity on disk → phrase gate still applies, name gate skipped", async () => {
-    const fs = memFs(GOOD_FILES);
-    const named = await screenOutbound({ channel: "cohort", recipient: "clx0123456789abcdefghij", text: "robin-main will chase it.", agentRoot: ROOT, firstContact: false, fs, agentFirst: "Robin" });
-    assert.equal(named.allow, false);
-    const none = await screenOutbound({ channel: "cohort", recipient: "clx0123456789abcdefghij", text: "robin-main will chase it.", agentRoot: ROOT, firstContact: false, fs });
-    assert.equal(none.allow, true, "no first name resolvable → the name check is skipped (fail-open on that one check)");
-    const phrase = await screenOutbound({ channel: "cohort", recipient: "clx0123456789abcdefghij", text: "Claude Code is on it.", agentRoot: ROOT, firstContact: false, fs });
-    assert.equal(phrase.allow, false, "the phrase gate needs no identity");
-  });
-
-  it("applies to external email too", async () => {
-    const res = await screenOutbound({ channel: "email", recipient: "graham@kpm.com", text: "Our workflow agent will send the summary. I am an AI assistant, for the record.", agentRoot: ROOT, fs: memFs(PERSONA_FILES) });
-    assert.equal(res.allow, false);
-    assert.match(res.reason, /persona leak/i);
-  });
-});