@cohortapp/agent-sdk 2.16.0 → 2.18.4

package/scripts/daemon/classifier.mjs

@@ -183,7 +183,9 @@ function loadAgentRegistry() {
 
 const ANTHROPIC_MODEL = "claude-haiku-4-5-20251001";
 // Resolve claude against the agent's PATH (not launchd's bare env).
-import { resolveClaudeBin, augmentedPath, daemonClaudeArgs } from "../../lib/claude-bin.mjs";
+import { resolveClaudeBin } from "../../lib/claude-bin.mjs";
+import { buildSpawn } from "../../lib/runtime/adapter.mjs";
+import { resolveSeatSpawn } from "../../lib/runtime/seat-engine.mjs";
 const CLAUDE_BIN = resolveClaudeBin();
 const CLAUDE_CLI_TIMEOUT_MS = 30_000;
 
@@ -241,7 +243,7 @@ Your job: classify each incoming message and return a JSON object with exactly t
   "priority": "critical" | "high" | "normal" | "ignore",
   "action": "respond" | "draft" | "research" | "queue" | "archive" | "ignore",
   "model": "opus" | "sonnet",
-  "summary": "<one-line summary of the message>",
+  "summary": "<one-line summary of WHAT THE MESSAGE ASKS OR SAYS — never the sender's title or rank>",
   "category": "action_required" | "fyi" | "ignore",
   "directed_at_agent": true | false,
   "answerable": true | false
@@ -293,8 +295,10 @@ DIRECTED_AT_AGENT (CRITICAL — determines whether ${agentName} should respond.
 - false: ${agentName} being in a thread does NOT mean every subsequent message is for them — only direct replies to their messages count
 - CRITICAL DEFAULT: When in doubt in any multi-person channel, group chat, or thread, ALWAYS default to false. ${agentName} must NOT insert themselves into conversations they weren't invited to. It is far worse to respond unnecessarily than to miss a message — someone will @mention ${agentName} if they need them.
 
-Context:
-- sender_privilege "ceo" = ${principalFullName} (always critical, always opus)
+Context — sender_privilege is a ROUTING TIER, not a fact about who the sender is.
+It is resolved upstream and can be wrong. It tells you how urgently to route; it
+never licenses you to state the sender's title.
+- sender_privilege "ceo" = the tier reserved for ${principalFullName} (always critical, always opus)
 - sender_privilege "leadership" = executive-team senders (CFO, CIO, General Counsel, and equivalent function heads) — usually high priority
 - sender_privilege "team" = internal team members
 - sender_privilege "external" = partners, candidates, advisors, vendors
@@ -302,19 +306,30 @@ Context:
 - service "gmail" with noreply/notifications senders = usually ignore
 - service "calendar" = meeting invites/updates, usually normal priority unless from CEO
 
+SUMMARY (read this before writing the field):
+The summary is NOT internal scratch. It is carried verbatim into the holding
+message a human reads, into the board row title, and into the one-line episode
+this seat writes to the ORG-WIDE shared memory, where other agents' recall()
+surfaces it as background context rather than as a claim anyone re-verifies.
+So: state what the message asks or says. NEVER open with, or otherwise assert,
+the sender's title, rank or office ("CEO ...", "Leadership ...", "the CFO
+asking ..."). Name the sender if you have their name; otherwise describe the
+ask. A rank you did not verify becomes a false statement about this
+organisation's governance the moment it leaves this process.
+
 Examples:
 
-Input: CEO DM on Slack: "Can you send the board resolution to Jordan?"
-Output: {"priority":"critical","action":"respond","model":"opus","summary":"CEO requesting board resolution sent to GC Jordan","category":"action_required","directed_at_agent":true,"answerable":false}
+Input: DM on Slack from ${principalFullName}: "Can you send the board resolution to Jordan?"
+Output: {"priority":"critical","action":"respond","model":"opus","summary":"${principalName} requesting the board resolution be sent to GC Jordan","category":"action_required","directed_at_agent":true,"answerable":false}
 
-Input: CEO DM on Slack: "what kind of machine are you running on?"
-Output: {"priority":"critical","action":"respond","model":"opus","summary":"CEO asking what machine/infrastructure the agent runs on","category":"action_required","directed_at_agent":true,"answerable":true}
+Input: DM on Slack from ${principalFullName}: "what kind of machine are you running on?"
+Output: {"priority":"critical","action":"respond","model":"opus","summary":"${principalName} asking what machine/infrastructure the agent runs on","category":"action_required","directed_at_agent":true,"answerable":true}
 
 Input: GitHub notification email about a merged PR
 Output: {"priority":"ignore","action":"ignore","model":"sonnet","summary":"GitHub PR merge notification","category":"ignore","directed_at_agent":false,"answerable":false}
 
 Input: Leadership Slack: "We need the the regulator gap analysis updated by Thursday"
-Output: {"priority":"high","action":"draft","model":"opus","summary":"Leadership requesting the regulator gap analysis update by Thursday deadline","category":"action_required","directed_at_agent":true,"answerable":false}
+Output: {"priority":"high","action":"draft","model":"opus","summary":"Request for the regulator gap analysis update by Thursday deadline","category":"action_required","directed_at_agent":true,"answerable":false}
 
 Input: Team member: "Standup notes from today's sync"
 Output: {"priority":"normal","action":"archive","model":"sonnet","summary":"Team standup notes shared","category":"fyi","directed_at_agent":false,"answerable":false}
@@ -325,8 +340,8 @@ Output: {"priority":"normal","action":"respond","model":"sonnet","summary":"Exte
 Input: Channel message from Jacob: "@${agentName} can you check the engine deployment?"
 Output: {"priority":"normal","action":"respond","model":"sonnet","summary":"Jacob asking ${agentName} to check engine deployment","category":"action_required","directed_at_agent":true,"answerable":false}
 
-Input: Channel message from CEO: "@AnotherAgent can you review the agentic libraries in this channel?"
-Output: {"priority":"normal","action":"archive","model":"sonnet","summary":"CEO asking another agent to review agentic libraries — not directed at ${agentName}","category":"fyi","directed_at_agent":false,"answerable":false}
+Input: Channel message from ${principalFullName}: "@AnotherAgent can you review the agentic libraries in this channel?"
+Output: {"priority":"normal","action":"archive","model":"sonnet","summary":"${principalName} asking another agent to review agentic libraries — not directed at ${agentName}","category":"fyi","directed_at_agent":false,"answerable":false}
 
 Input: Channel message from Sam to Jordan: "Jordan, did you file the compliance response yet?"
 Output: {"priority":"normal","action":"archive","model":"sonnet","summary":"Sam asking Jordan about compliance response filing","category":"fyi","directed_at_agent":false,"answerable":false}
@@ -450,22 +465,44 @@ export function parseClassification(text) {
 //   • Any failure (non-zero exit, timeout, unparseable output) throws so
 //     the Tier-2 llmTask fallback engages exactly as before.
 
+/**
+ * The classifier lane's spawn from the runtime adapter (lane "classifier"):
+ * --print <permissions> <bare MCP> --model <m> --append-system-prompt <sys>,
+ * prompt on stdin; stock env posture (stale ANTHROPIC_API_KEY/AUTH_TOKEN
+ * stripped, PATH augmented).
+ *
+ * W4-E1 (CF-44): `seat` is the seat's engine resolved once for this spawn. A
+ * claude seat adds no fields (unchanged); an engine-cohort seat runs `cli.mjs run`.
+ * @param {{systemPrompt:string, userPrompt:string, env?:object, bin?:string, seat?:{fields:object}}} o
+ */
+export function classifierSpawn({ systemPrompt, userPrompt, env = process.env, bin = CLAUDE_BIN, seat = { fields: {} } }) {
+  return buildSpawn({
+    lane: "classifier",
+    bin,
+    model: ANTHROPIC_MODEL,
+    systemPrompt,
+    prompt: userPrompt,
+    permissions: sessionPermissionArgs({ source: "classifier" }),
+    mcp: { source: "classifier" },
+    env,
+    ...seat.fields,
+  });
+}
+
 async function runClaudeCLI(systemPrompt, userPrompt) {
+  // W4-E1: the seat's engine, once per spawn (a claude seat reads config/agent.json only).
+  const seat = await resolveSeatSpawn(agentDir());
   return new Promise((resolvePromise, rejectPromise) => {
-    const args = [
-      "--print",
-      ...sessionPermissionArgs({ source: "classifier" }),
-      ...daemonClaudeArgs(undefined, { source: "classifier" }),
-      "--model", ANTHROPIC_MODEL,
-      "--append-system-prompt", systemPrompt,
-    ];
-
-    const proc = spawn(CLAUDE_BIN, args, {
+    const spawnSpec = classifierSpawn({ systemPrompt, userPrompt, seat });
+    if (!spawnSpec.ok) {
+      // Throw-path parity: a rejection engages the Tier-2 llmTask fallback.
+      rejectPromise(new Error(`claude CLI unavailable: ${spawnSpec.error.message}`));
+      return;
+    }
+
+    const proc = spawn(spawnSpec.bin, spawnSpec.argv, {
       stdio: ["pipe", "pipe", "pipe"],
-      // Force claude CLI onto keychain OAuth (Max subscription); strip any
-      // stale ANTHROPIC_API_KEY/AUTH_TOKEN inherited from the daemon env.
-      // Augment PATH so spawned subsessions find homebrew/nvm binaries.
-      env: { ...process.env, PATH: augmentedPath(), ANTHROPIC_API_KEY: "", ANTHROPIC_AUTH_TOKEN: "" },
+      env: spawnSpec.env,
     });
 
     let stdout = "";
@@ -671,12 +708,24 @@ function classifyWithRules(item) {
   const directed = isDirectedAtAgent(item);
 
   // CEO → critical, opus (but in channels, respect directed check)
+  //
+  // The summary deliberately does NOT name the tier ("CEO message from …").
+  // sender_privilege is a routing tier resolved upstream and it has been wrong
+  // fleet-wide: the answerItem() call site (now resolveSenderPrivilege() in
+  // agent-daemon.mjs) once read the unparenthesised
+  // `a || b ? "ceo" : "unknown"`, which stamped every sender "ceo". The
+  // summary is carried verbatim into holding text, board rows and org-wide
+  // memory, so a tier name here becomes an asserted fact about the sender's
+  // office that nothing downstream re-verifies. Route on the tier; never
+  // narrate it. (The rules-path sweep covered every summary below: the
+  // urgent-keyword limb's "Urgent message from …" names the message's own
+  // content, not a rank, and is kept as is.)
   if (item.sender_privilege === "ceo") {
     return {
       priority: "critical",
       action: directed ? "respond" : "archive",
       model: "opus",
-      summary: `CEO message from ${item.sender}`,
+      summary: `Message from ${item.sender}`,
       category: directed ? "action_required" : "fyi",
       directed_at_agent: directed,
     };
@@ -688,7 +737,7 @@ function classifyWithRules(item) {
       priority: "high",
       action: directed ? "respond" : "archive",
       model: "opus",
-      summary: `Leadership message from ${item.sender}`,
+      summary: `Message from ${item.sender}`,
       category: directed ? "action_required" : "fyi",
       directed_at_agent: directed,
     };

package/scripts/daemon/context-compiler.mjs

@@ -5,7 +5,8 @@
  * Single export: compileContext(item, classResult, options)
  *
  * Assembles sender profile, disclosure boundaries, conversation history,
- * active sessions, and sent-message registry into a single context block.
+ * current work (this agent's sessions on the machine), and sent-message
+ * registry into a single context block.
  * Filters history entries by information barrier domains.
  *
  * Adaptive token budget: 12K for critical/high, 8K for normal, 4K for low.
@@ -15,6 +16,9 @@ import { readFileSync, readdirSync } from "fs";
 import { join } from "path";
 import { isEnabled as orgEnabled, loadOrgConfig } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
+import { isPrivateConversation, historyDirNames } from "../../lib/context/history-scope.mjs";
+import { fitSections } from "../../lib/context/budget.mjs";
+import { currentWorkBlock, audienceForItem } from "../../lib/session/current-work.mjs";
 
 const AGENT_REPO_DIR = process.env.__TEST_AGENT_DIR || process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 const SESSION_DIR = process.env.__TEST_SESSION_DIR || join(AGENT_REPO_DIR, "state", "sessions");
@@ -56,6 +60,8 @@ const HISTORY_SHARE = 0.6;
  */
 function extractChannelId(item) {
   if (!item) return null;
+  // Every non-Slack service sets this outright; Slack is the one that has to be
+  // dug out of `raw_ref`.
   if (item.channel_id) return item.channel_id;
   if (item.raw_ref) {
     const match = item.raw_ref.match(/slack:([DC][A-Z0-9]+):/);
@@ -164,6 +170,24 @@ function matchesForbiddenDomain(text, forbiddenDomains, domainKeywords) {
   return false;
 }
 
+/**
+ * The information-barrier predicate for a sender: `text → true` when the text
+ * trips 2+ keywords of a domain that sender may not see. This is the SAME test
+ * `loadConversationHistory` applies to each history turn, exported so the
+ * current-work block gets it on BOTH reply paths (the quick path has no
+ * barrier machinery of its own and imports this). Fail-closed on a sender we
+ * cannot evaluate: `forbiddenDomains` for an unknown sender is every domain.
+ *
+ * @param {string|null} senderSlug
+ * @returns {(text:string)=>boolean}
+ */
+export function forbidsTextFor(senderSlug) {
+  const { forbiddenDomains } = loadDisclosureBoundaries(senderSlug, ALLOC.boundaries);
+  if (!forbiddenDomains || forbiddenDomains.length === 0) return () => false;
+  const domainKeywords = buildDomainKeywords();
+  return (text) => matchesForbiddenDomain(String(text || ""), forbiddenDomains, domainKeywords);
+}
+
 /**
  * Load disclosure boundaries for a sender.
  * Returns { boundariesSection, forbiddenDomains }.
@@ -234,14 +258,32 @@ function loadDisclosureBoundaries(senderSlug, budgetTokens) {
 
 /**
  * Load conversation history from interaction logs, filtered by disclosure boundaries.
+ *
+ * READS THE ITEM'S OWN SERVICE. `responder.mjs#logInteraction` files every
+ * exchange under `memory/interactions/<service>/…`; this read was pinned to
+ * `…/slack/…`, so a Cohort, Telegram or WhatsApp exchange was written down and
+ * then never found (design §3 R12) — which is how "why can't you see the
+ * context of our ongoing conversation?" happened in a thread whose whole
+ * history was on disk the whole time.
+ *
+ * Slack keeps its legacy bare `<sender-slug>` directory alongside the `dm-`
+ * one, so historical logs do not go dark on this change.
+ *
+ * AND IT READS ONLY WHAT THIS ROOM MAY SEE. `logInteraction` files every
+ * exchange under BOTH the room and `dm-<sender-slug>`, so merging the candidate
+ * directories put one person's private DM sentence into the prompt built for a
+ * public channel the moment this read stopped being Slack-only. The gate lives
+ * in `lib/context/history-scope.mjs`, shared with the legacy prompt path and
+ * with the writer (design §5.5, resource scope).
  */
-function loadConversationHistory(senderSlug, channelId, budgetTokens, forbiddenDomains) {
-  const candidateDirs = [];
-  if (channelId) candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
-  if (senderSlug) {
-    candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
-    candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", senderSlug));
-  }
+function loadConversationHistory(senderSlug, channelId, budgetTokens, forbiddenDomains, service = "slack", isPrivate = false) {
+  const svc = String(service || "slack");
+  const candidateDirs = historyDirNames({
+    channelId,
+    senderSlug,
+    isPrivate: isPrivate === true,
+    service: svc,
+  }).map((name) => join(AGENT_REPO_DIR, "memory", "interactions", svc, name));
 
   const entries = [];
   const seenKeys = new Set();
@@ -292,65 +334,60 @@ function loadConversationHistory(senderSlug, channelId, budgetTokens, forbiddenD
 
   if (filtered.length === 0) return null;
 
-  // Truncate to character budget — most recent messages prioritised (iterate from end)
-  const charBudget = budgetTokens * CHARS_PER_TOKEN;
-  const outputLines = [];
-  let totalChars = 0;
-
-  for (let i = filtered.length - 1; i >= 0; i--) {
-    const entry = filtered[i];
+  // Spend the budget from the NEWEST turn backwards, and SAY what fell off.
+  // This used to `break` out of the loop and return the survivors, so a prompt
+  // that had quietly lost thirty turns of a conversation looked exactly like a
+  // conversation thirty turns shorter — design §5.4: "dropping is visible in
+  // the prompt, never silent". `lib/context/budget.mjs` owns the arithmetic and
+  // the wording; this function only supplies the turns.
+  const turns = filtered.map((entry) => {
     const from = entry.from || entry.sender || entry.user_name || "unknown";
     const text = entry.content || entry.text || "(no text)";
     const ts = entry.received_at || entry.timestamp || entry.processed_at || entry.ts || "";
     const responded = entry.response_sent ? " [Responded]" : "";
-    const line = `[${ts}] ${from}: ${text.substring(0, 500)}${responded}`;
+    return `[${ts}] ${from}: ${text.substring(0, 500)}${responded}`;
+  });
 
-    if (totalChars + line.length > charBudget) break;
-    outputLines.unshift(line);
-    totalChars += line.length;
-  }
+  const fitted = fitSections({
+    sections: [{ name: "thread", turns }],
+    budgetTokens: Math.max(1, Number(budgetTokens) || 0),
+    charsPerToken: CHARS_PER_TOKEN,
+  });
 
-  return outputLines.length > 0 ? outputLines.join("\n") : null;
+  return fitted.text ? fitted.text : null;
 }
 
-// ── Active sessions ────────────────────────────────────────────────
+// ── Current work (the agent's own sessions on this machine) ────────
 
 /**
- * Load active sessions and format as bullet list.
+ * The bounded "what am I doing right now" block — lib/session/current-work.
+ *
+ * This used to read `active.json` alone: the daemon's own `--print` children,
+ * summary + model + sender, nothing else. A human asking "what are you doing
+ * right now, across sessions on your machine?" was answered from a list that
+ * did not contain the front door, its peers, the board items in progress, or
+ * the fact that a person had an interactive session open. The block now
+ * carries all of those (and names the board item where one is linked), under
+ * the same token allocation, and reports a human's session as EXISTING only.
+ *
+ * SCOPED TO THE AUDIENCE. The old list put every live session's summary —
+ * the classifier's restatement of some other person's message — into any
+ * reply's context. The block is now rendered for `item`'s conversation
+ * (`audienceForItem`): a session from another conversation is reported as
+ * existing only, and what is disclosable passes the same information-barrier
+ * keyword filter the history above it does (`forbiddenDomains`).
  */
-function loadActiveSessions(budgetTokens) {
+async function loadCurrentWork(budgetTokens, item, forbiddenDomains) {
   try {
-    const filePath = join(SESSION_DIR, "active.json");
-    const raw = readFileSync(filePath, "utf-8");
-    const data = JSON.parse(raw);
-
-    // data may be an object with session entries or an array
-    const sessions = Array.isArray(data) ? data : Object.values(data);
-    if (sessions.length === 0) return null;
-
-    const lines = [];
+    const domainKeywords = forbiddenDomains && forbiddenDomains.length > 0 ? buildDomainKeywords() : null;
+    const audience = audienceForItem(item, {
+      isPrivate: isPrivateConversation(item),
+      forbidsText: domainKeywords ? (t) => matchesForbiddenDomain(t, forbiddenDomains, domainKeywords) : undefined,
+    });
+    const block = await currentWorkBlock(AGENT_REPO_DIR, { activePath: join(SESSION_DIR, "active.json"), audience });
+    if (!block) return null;
     const charBudget = budgetTokens * CHARS_PER_TOKEN;
-    let totalChars = 0;
-
-    for (const sess of sessions) {
-      const id = sess.sessionId || sess.id || "unknown";
-      const summary = sess.summary || sess.task || "no summary";
-      const model = sess.model || "unknown";
-      const sender = sess.sender || sess.owner || "unknown";
-      const started = sess.startTime || sess.started_at || "";
-      let age = "";
-      if (started) {
-        const ms = Date.now() - new Date(started).getTime();
-        const mins = Math.round(ms / 60000);
-        age = `${mins}m ago`;
-      }
-      const line = `- ${id}: ${summary} (model=${model}, sender=${sender}${age ? ", " + age : ""})`;
-      if (totalChars + line.length > charBudget) break;
-      lines.push(line);
-      totalChars += line.length;
-    }
-
-    return lines.length > 0 ? lines.join("\n") : null;
+    return block.length > charBudget ? block.slice(0, charBudget) : block;
   } catch {
     return null;
   }
@@ -522,10 +559,18 @@ export async function compileContext(item, classResult, options = {}) {
     const fixedTokens = ALLOC.profile + ALLOC.boundaries + ALLOC.active_sessions + ALLOC.sent_registry + ALLOC.org_memory;
     const remainingTokens = tokenBudget - fixedTokens;
     const historyBudget = Math.floor(remainingTokens * HISTORY_SHARE);
-    const historyText = loadConversationHistory(senderSlug, channelId, historyBudget, forbiddenDomains);
-
-    // Step 5 — Active sessions
-    const sessionsText = loadActiveSessions(ALLOC.active_sessions);
+    const historyText = loadConversationHistory(
+      senderSlug,
+      channelId,
+      historyBudget,
+      forbiddenDomains,
+      item?.service,
+      isPrivateConversation(item),
+    );
+
+    // Step 5 — Current work (this agent's sessions on this machine, bounded,
+    // scoped to this item's conversation and the sender's barrier)
+    const sessionsText = await loadCurrentWork(ALLOC.active_sessions, item, forbiddenDomains);
 
     // Step 6 — Sent registry
     const sentText = loadSentRegistry(channelId, ALLOC.sent_registry);
@@ -568,7 +613,7 @@ export async function compileContext(item, classResult, options = {}) {
     sections.push("");
 
     if (sessionsText) {
-      sections.push("## Active Sessions");
+      // The block carries its own "## Current Work" header.
       sections.push(sessionsText);
       sections.push("");
     }

package/scripts/daemon/deliver.mjs

@@ -118,7 +118,10 @@ export function resolveSlackChannel(item) {
  */
 
 /** Surfaces that genuinely live in a Cohort room — these reply with a message. */
-const CHANNEL_SURFACES = Object.freeze(["dm", "mention", "thread_reply", "call"]);
+// `broadcast` is a room message like a mention: the roll-call answer posts
+// into the space it was asked in. Without this entry the reply has no
+// transport, `canDeliverTo` says no, and the surface is dark at the last step.
+const CHANNEL_SURFACES = Object.freeze(["dm", "mention", "broadcast", "thread_reply", "call"]);
 
 /**
  * Error frame codes a retry cannot change.
@@ -624,6 +627,26 @@ async function sendCohortEntityComment(route, text, o = {}) {
 // The one public entry point
 // ---------------------------------------------------------------------------
 
+// Refuse any outbound body carrying raw scaffold markup. A closing </thinking>,
+// an <assistant> wrapper and a <user_message> marker have each reached a shared
+// room, from three separate seats. The seam is the join between the daemon
+// placeholder and the generated output; whatever the cause on a given seat,
+// nothing carrying these markers may leave it. Permanent refusal (no retry),
+// same shape as the persona-leak gate: the caller escalates, never re-sends.
+const SCAFFOLD_MARKER_RE = /<\/?(thinking|assistant|user_message|user|system|antml:[a-z_]+)>/i;
+
+/**
+ * The first raw scaffold marker in `text`, or null when it carries none.
+ * Prose that merely NAMES a marker ("the thinking tag") is not a leak — only
+ * the literal angle-bracketed form matches.
+ * @param {string} text
+ * @returns {string|null}
+ */
+export function scaffoldMarkerLeak(text) {
+  const m = typeof text === "string" ? text.match(SCAFFOLD_MARKER_RE) : null;
+  return m ? m[0] : null;
+}
+
 /**
  * Deliver `text` to the human behind `item`. No generation, no model, no
  * budget — only transport.
@@ -657,6 +680,12 @@ export async function deliver(item, text, o = {}) {
   if (!item || !text || !String(text).trim()) {
     return { sent: false, via: null, error: "nothing to deliver" };
   }
+  const leak = scaffoldMarkerLeak(text);
+  if (leak) {
+    const surface = (item && item.channel_id) ? "room" : "unknown";
+    try { console.error(`[deliver] refused: raw scaffold marker ${JSON.stringify(leak)} in outbound body (permanent, not retrying)`); } catch { /* */ }
+    return { sent: false, via: null, permanent: true, channel: item && item.channel_id, surface, code: "FORBIDDEN_SCOPE", error: `FORBIDDEN_SCOPE: raw scaffold marker ${leak} in outbound body — strip the marker; never send reasoning or transcript wrappers` };
+  }
   // `permanent` says retrying changes nothing. A caller that cannot tell the
   // difference between "hq blipped" and "there is no transport for telegram"
   // retries both at the same cadence, which is how an impossible send becomes an