@cohortapp/agent-sdk 2.18.11 → 2.18.13

package/lib/comms/send-gate.mjs

@@ -549,10 +549,12 @@ export function screenDisclosure(text, { policy, jurisdiction, firstContact, rec
   //
   // Unscoped on the second axis, this screen blocked every internal post that
   // did not carry the identity line — which taught agents to open every
-  // message, including mid-thread corrections to their own numbers, with
-  // "Quick note before we get into it: I'm <name>, an AI assistant working
-  // with <principal>". The block was doing that, not the model: the only way
-  // past a gate that demands disclosure is to disclose.
+  // message, including mid-thread corrections to their own numbers, with a
+  // rendering of `channels.<c>.identity_line`. It is not quoted here on
+  // purpose: a banned string reproduced in a comment is how the next author
+  // reads it in good faith and writes it back into the product. The block was
+  // doing that, not the model: the only way past a gate that demands
+  // disclosure is to disclose.
   //
   // A channel may narrow it further via `channels.<channel>.identity_scope`,
   // the same shape the email footer already carries.

package/lib/identity/claude-md.mjs

@@ -0,0 +1,107 @@
+/**
+ * claude-md.mjs — reading a seat's CLAUDE.md into a prompt preamble.
+ *
+ * WHY THIS MODULE EXISTS
+ *   Both prompt planes scrape the seat's CLAUDE.md for house-style sections:
+ *   the 60-second quick reply (scripts/daemon/responder.mjs#loadPreamble) and
+ *   the full session (scripts/daemon/prompt-builder.mjs#extractPreamble). They
+ *   had SEPARATE copies of the scrape, and only one of them was ever fixed — so
+ *   the fix for "the preamble hands the model an unresolved identity template"
+ *   landed on the quick reply while the session plane, which is the tier a
+ *   substantive reply actually escalates to, kept every defect. One definition,
+ *   two callers, is the only shape that cannot drift that way again.
+ *
+ * PURE. Every function here takes the file's text as a parameter and returns a
+ * string; nothing reads the filesystem, the clock or the environment, so what a
+ * given seat file yields is a unit test (claude-md.test.mjs).
+ */
+
+/**
+ * A scaffold placeholder line — `*Configured by \`maestro setup\`*` and variants.
+ *
+ * The scaffold ships these under `## Company Context` and `### Autonomy Model`,
+ * and the scrape handed them to the model verbatim: a standing note, on every
+ * turn, that the seat's company context and autonomy bands are unconfigured.
+ * That is the same "you are not set up" signal that pushes a model into the
+ * generic-assistant register in which it introduces itself.
+ */
+export const SCAFFOLD_SENTINEL = /^\s*\*?\s*(?:Configured by|To be configured|TBD)\b[^\n]*$/i;
+
+/** Markdown heading depth, 0 for a non-heading. @param {string} l @returns {number} */
+function headingDepth(l) {
+  const m = /^(#{2,6})\s+\S/.exec(l);
+  return m ? m[1].length : 0;
+}
+
+/**
+ * Drop scaffold placeholder lines, and any heading they leave empty. PURE.
+ *
+ * A heading with nothing under it says less than nothing, so it goes with its
+ * placeholder rather than standing as an unanswered promise.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function stripScaffoldSentinels(text) {
+  const kept = String(text || "").split("\n").filter((l) => !SCAFFOLD_SENTINEL.test(l));
+  // Second pass: a heading whose whole body was a sentinel is now empty.
+  const out = [];
+  for (let i = 0; i < kept.length; i++) {
+    const line = kept[i];
+    const depth = headingDepth(line);
+    if (depth) {
+      let j = i + 1;
+      while (j < kept.length && kept[j].trim() === "") j++;
+      // Empty only when EOF follows, or a heading at the SAME OR SHALLOWER
+      // level. A parent heading followed by its own subheading has a body.
+      const next = j < kept.length ? headingDepth(kept[j]) : 0;
+      if (j >= kept.length || (next && next <= depth)) continue;
+    }
+    out.push(line);
+  }
+  return out.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+}
+
+/**
+ * Scrape the named `##` sections out of a CLAUDE.md. PURE, so which sections a
+ * given seat file yields is a unit test.
+ *
+ * @param {string} raw        CLAUDE.md contents
+ * @param {string[]} targets  `## ` headings to keep
+ * @returns {string}
+ */
+export function scrapeClaudeMdSections(raw, targets) {
+  const sections = [];
+  let capturing = false;
+  for (const line of String(raw || "").split("\n")) {
+    if (targets.some((h) => line.startsWith(h))) { capturing = true; sections.push(line); continue; }
+    if (capturing && /^## [A-Z]/.test(line) && !targets.some((h) => line.startsWith(h))) { capturing = false; continue; }
+    if (capturing) sections.push(line);
+  }
+  return sections.join("\n").trim();
+}
+
+/**
+ * The `##` headings a preamble scrape should keep.
+ *
+ * `## Identity` is kept ONLY when no persona block rendered. On an enrolled
+ * seat the persona is resolved from config/agent.json and the CLAUDE.md
+ * `## Identity` section is still the scaffold template — unresolved
+ * `{{agent.fullName}}` tokens followed by "If those tokens are still
+ * unresolved, your identity has not been configured yet — run … maestro setup".
+ * Rendering both gives the model a correct identity immediately followed by a
+ * notice that its identity is unconfigured; two identity blocks, one of them
+ * unresolved, is worse than either alone.
+ *
+ * On an UNENROLLED seat there is no persona, and the scaffold section — tokens
+ * and all — is the only identity prose there is. It is restored deliberately:
+ * a prompt that says "run maestro setup" is the honest rendering of a seat
+ * that has not been set up.
+ *
+ * @param {boolean} hasPersona  did renderSeatPersona() produce a block?
+ * @param {string[]} houseStyle extra `## ` headings this plane wants
+ * @returns {string[]}
+ */
+export function preambleTargets(hasPersona, houseStyle) {
+  return hasPersona ? [...houseStyle] : ["## Identity", ...houseStyle];
+}

package/lib/identity/disclosure-instructions.mjs

@@ -0,0 +1,148 @@
+/**
+ * disclosure-instructions.mjs — a standing instruction to VOLUNTEER what the
+ * agent is must not reach a prompt, wherever it was written.
+ *
+ * WHAT BROKE
+ *   Seats posted a self-introduction into the middle of live threads — a rendering
+ *   of `channels.<c>.identity_line` from policies/ai-disclosure.yaml, the
+ *   opener naming the agent's own nature and pairing it with its principal —
+ *   on a release-status post and on a correction to the agent's
+ *   OWN earlier figures, in the org's own #risk-compliance channel. Two causes
+ *   were framework-side and are fixed in code (an unresolved identity template,
+ *   and an unframed transcript). The THIRD is not framework-side at all:
+ *
+ *   The preamble scrape copies `## Communication Rules` out of the SEAT'S OWN
+ *   CLAUDE.md, verbatim. A seat file carrying a standing rule of the
+ *   shape "on first message in any thread, introduce yourself as <the
+ *   identity_line>" puts that line straight into every prompt the seat builds, and it survives every
+ *   `maestro` upgrade — the repo cannot see it, and a repo test that renders the
+ *   scaffold will never fail on it.
+ *
+ *   So the check has to run at RUNTIME over the composed preamble, on the text
+ *   that is actually about to be handed to the model, rather than in a test over
+ *   a file the fleet does not use.
+ *
+ * WHAT THIS IS NOT
+ *   It is NOT a disclosure policy and it must never weaken one. The truthfulness
+ *   invariant — a sincere question about whether someone is an AI is answered
+ *   plainly — lives in lib/identity/persona.mjs#voiceRules and
+ *   policies/ai-disclosure.yaml, and is untouched here. What these patterns
+ *   describe is the UNPROMPTED self-introduction: an instruction to open with,
+ *   attach, or lead with a statement of what the agent is.
+ *
+ *   Because of that distinction the patterns are deliberately narrow, and a line
+ *   that FORBIDS the behaviour is kept rather than dropped ({@link PROHIBITION}):
+ *   stripping "never introduce yourself as an AI" would remove a rule that says
+ *   exactly what this module wants said. A pointer to the disclosure policy —
+ *   "policies/ai-disclosure.yaml is the authority on where proactive disclosure
+ *   is legally required" — is likewise a restraint, not an instruction, and is
+ *   kept; every pattern below therefore requires an imperative verb rather than
+ *   matching the bare words "proactive disclosure".
+ *
+ * PURE. No I/O, no clock, no env — the caller supplies the text and receives the
+ * text plus what was dropped, so the exact behaviour is a unit test.
+ */
+
+/**
+ * Instructions to volunteer what the agent is.
+ *
+ * Deliberately narrower than "the word AI appears": the persona block's
+ * truthfulness bullet contains "AI" and MUST keep containing it.
+ */
+export const DISCLOSURE_INSTRUCTION_PATTERNS = Object.freeze([
+  // "state that you are an AI assistant", "mention you're a bot", …
+  /\b(?:state|disclose|declare|mention|note|announce|say|confirm)\b[^.\n]{0,60}\b(?:you are|you're|that you are|yourself as)\b[^.\n]{0,40}\b(?:an? AI\b|AI (?:assistant|agent)|artificial intelligence|a bot\b|a language model)/i,
+  // "introduce yourself", "identify yourself as …"
+  /\bintroduce yourself\b/i,
+  /\bidentify yourself as\b/i,
+  // Prose that IS the self-introduction, quoted as a model to copy.
+  /\ban AI (?:assistant|agent) working (?:with|for|alongside|on behalf of)\b/i,
+  // "add the identity line", "lead with an AI-disclosure statement", …
+  /\b(?:add|include|append|prepend|attach|open with|lead with|start with|begin with|preface \w+ with|end with|sign off with)\b[^.\n]{0,60}\b(?:identity line|proactive[_ ]disclosure|AI[- ]disclosure|disclosure (?:line|statement|notice))/i,
+  // The observed opener itself, as a template to follow.
+  /\bbefore we (?:get into it|begin|start)\b/i,
+]);
+
+/**
+ * A line that FORBIDS the behaviour rather than demanding it.
+ *
+ * Checked against the text BEFORE the match, so "Do not introduce yourself" is
+ * kept while "On first message, introduce yourself" is dropped. Deliberately
+ * generous — keeping a line the stripper was unsure about is the safe error,
+ * because the only cost of a kept prohibition is a duplicate of a rule the
+ * framework already states, while the cost of a dropped one is a rule lost.
+ */
+const PROHIBITION = /\b(?:do not|don'?t|never|no need to|must not|should not|avoid|without|rather than|instead of|refrain from|stop)\b/i;
+
+/**
+ * Does this ONE line read as an instruction to volunteer what the agent is?
+ *
+ * @param {string} line
+ * @returns {RegExp|null} the pattern that matched, or null
+ */
+export function disclosureInstructionMatch(line) {
+  const text = String(line || "");
+  if (!text.trim()) return null;
+  for (const rx of DISCLOSURE_INSTRUCTION_PATTERNS) {
+    const m = rx.exec(text);
+    if (!m) continue;
+    // A prohibition anywhere before the match keeps the line.
+    if (PROHIBITION.test(text.slice(0, m.index))) continue;
+    return rx;
+  }
+  return null;
+}
+
+/**
+ * Drop every line of `text` that instructs the agent to introduce or disclose
+ * itself, and report what went.
+ *
+ * LINE GRANULARITY IS THE POINT. This runs over seat-authored prose whose shape
+ * nothing here controls; a line is the largest unit that can be removed without
+ * guessing where a rule begins and ends. A bullet with indented sub-bullets
+ * therefore loses only its own line, which reads as a truncated rule rather than
+ * a silently rewritten one — and `dropped` is returned so the caller can say so
+ * out loud instead of editing the operator's file behind their back.
+ *
+ * @param {string} text
+ * @returns {{text: string, dropped: string[]}}
+ */
+export function stripDisclosureInstructions(text) {
+  const src = String(text || "");
+  if (!src) return { text: "", dropped: [] };
+  const dropped = [];
+  const kept = src.split("\n").filter((line) => {
+    if (!disclosureInstructionMatch(line)) return true;
+    dropped.push(line.trim());
+    return false;
+  });
+  return { text: kept.join("\n").replace(/\n{3,}/g, "\n\n"), dropped };
+}
+
+/**
+ * Strip, and WARN ONCE PER PROCESS per distinct line, naming the file the line
+ * came from. The seat operator cannot see this from the repo, so silence is the
+ * failure mode that let it run for as long as it did.
+ *
+ * @param {string} text
+ * @param {string} source  a human-readable provenance, e.g. "<seat>/CLAUDE.md"
+ * @param {(msg:string)=>void} [warn]
+ * @returns {string}
+ */
+const _warned = new Set();
+export function stripDisclosureInstructionsAndWarn(text, source, warn = console.error) {
+  const { text: out, dropped } = stripDisclosureInstructions(text);
+  for (const line of dropped) {
+    const key = `${source}::${line}`;
+    if (_warned.has(key)) continue;
+    _warned.add(key);
+    warn(
+      `[identity] dropped a self-introduction instruction from ${source}: ${JSON.stringify(line.slice(0, 200))}` +
+      ` — agents do not announce what they are unprompted; edit that file to remove the line.`,
+    );
+  }
+  return out;
+}
+
+/** For tests. */
+export const _test = { PROHIBITION };

package/lib/identity/disclosure-scrub.mjs

@@ -0,0 +1,207 @@
+/**
+ * disclosure-scrub.mjs — remove a standing-self-identification INSTRUCTION from
+ * seat-local prose before it reaches the model.
+ *
+ * WHY A COUNTER-INSTRUCTION IS NOT ENOUGH
+ *   Two of the three prompt planes build their identity by scraping prose out of
+ *   the SEAT's own files — `## Identity` / `## Company Context` /
+ *   `## Communication Rules` from the seat's CLAUDE.md
+ *   (scripts/daemon/responder.mjs#loadPreamble,
+ *   scripts/daemon/prompt-builder.mjs#extractPreamble) and the per-sender YAML
+ *   under memory/profiles/users/. `maestro upgrade` deliberately never touches
+ *   either, so whatever a seat was scaffolded or hand-edited with in 2026-08
+ *   is still there and still first in the prompt.
+ *
+ *   Some seats were hand-edited, in good faith, to carry the disclosure opener
+ *   as a STANDING RULE — because for a while the send gate demanded it and the
+ *   only way past a gate that demands disclosure is to disclose. Shipping
+ *   `SELF_PRESENTATION` (lib/identity/persona.mjs) puts the correct rule in the
+ *   prompt, but it does not remove the seat-local one: the model is then handed
+ *   two contradictory instructions, the seat's one arrives ~700 characters
+ *   earlier, and on the full-session plane it lands immediately after the
+ *   sentence that declares the identity section authoritative. Adding text
+ *   cannot win that; removing the contradiction can.
+ *
+ * WHAT IS REMOVED, AND WHAT IS DELIBERATELY NOT
+ *   Removed: a LINE that reproduces one of the proactive-disclosure templates in
+ *   policies/ai-disclosure.yaml, or that instructs self-announcement in the
+ *   abstract ("open every message by introducing yourself as an AI assistant").
+ *
+ *   NOT removed: anything about answering honestly WHEN ASKED. That is the
+ *   non-overridable invariant in policies/ai-disclosure.yaml and it must survive
+ *   this scrub intact — {@link ASKED_SHAPE} exempts it explicitly. Scrubbing it
+ *   would turn a fix for an unprompted disclaimer into a licence to conceal,
+ *   which is the one thing nothing in this tree is allowed to do.
+ *
+ *   Also not removed: the external-first-contact duty as POLICY. This module
+ *   edits prompt text only. `lib/comms/send-gate` remains the thing that decides
+ *   when the line is actually owed, and it still demands it for an external
+ *   first contact.
+ *
+ * THE BANNED TEXT IS QUOTED NOWHERE HERE. The fragments are derived from
+ * policies/ai-disclosure.yaml at run time. A guard that reproduces the string it
+ * guards against is how the string gets reseeded — the next author reads it in a
+ * comment and writes it back in, in good faith.
+ *
+ * Pure core (`deriveDisclosureFragments`, `scrubDisclosureInstructions`) so the
+ * behaviour is testable without a filesystem; the I/O wrapper never throws and
+ * fails OPEN (shape rules only), because no scrub is worth failing a send.
+ */
+
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { join, dirname } from "path";
+
+/** The framework's own copy of the policy — NOT the seat's. */
+const PACKAGED_POLICY = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "policies", "ai-disclosure.yaml");
+
+/**
+ * A line that is about answering a QUESTION is never scrubbed, whatever else it
+ * says. The truthfulness invariant reads exactly like a self-identification
+ * instruction to a dumb matcher, and it is the one line that must survive.
+ */
+const ASKED_SHAPE = /\b(?:if|when|whenever|should)\b[^.\n]{0,60}\b(?:ask|asks|asked|asking|question|questions|enquir|inquir)/i;
+
+/** The self-nature noun phrase an announcement instruction has to name. */
+const SELF_NATURE = /\b(?:an?\s+(?:ai|a\.i\.)\b|ai\s+(?:assistant|agent|bot|helper|colleague|model|system)|\bbot\b|\bchatbot\b|language model)/i;
+
+/** The act of putting it at the top of a message. */
+const ANNOUNCE_VERB = /\b(?:open(?:s|ing)?|begin(?:s|ning)?|start(?:s|ing)?|lead(?:s|ing)?\s+with|preface|precede|introduce|introducing|announce|announcing|identify\s+yourself|present\s+yourself|state\s+up\s+front|sign(?:s|ing)?\s+off|disclaimer|disclose)\b/i;
+
+/** Second-person/first-person orientation — an instruction ABOUT THE AGENT. */
+const SELF_REF = /\b(?:you|your|yourself|i'?m|i\s+am|my|me|myself|the\s+agent)\b/i;
+
+/** Minimum length of a derived policy fragment worth matching a line against. */
+const MIN_FRAGMENT = 14;
+
+/**
+ * Every proactive-disclosure template in the AI-disclosure policy, reduced to the
+ * literal prose an agent would have to write.
+ *
+ * Deliberately a dumb line scan rather than a YAML parse: the policy file is the
+ * INPUT to this derivation, so the derivation must not depend on the file being
+ * well-formed enough to parse. A malformed policy must degrade to "fewer
+ * fragments", never to a throw on the send path.
+ *
+ * @param {string} policyText  raw contents of policies/ai-disclosure.yaml
+ * @returns {string[]} distinctive lower-cased fragments
+ */
+export function deriveDisclosureFragments(policyText) {
+  const out = new Set();
+  const lines = String(policyText || "").split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    // The proactive templates only. `truthful_answer_template` is the INVARIANT's
+    // text — the honest answer to a direct question — and must never be scrubbed
+    // out of anything.
+    if (!/^\s*(identity_line|footer):\s*>/.test(lines[i])) continue;
+    const body = [];
+    for (let j = i + 1; j < lines.length; j++) {
+      const l = lines[j];
+      if (l.trim() === "") break;
+      if (l.trim().startsWith("#")) break;       // a comment ends the block scalar
+      if (!/^\s{6,}\S/.test(l)) break;
+      body.push(l.trim());
+    }
+    for (const piece of body.join(" ").split(/\{[a-z_]+\}/i)) {
+      const p = piece.replace(/\s+/g, " ").replace(/^[\s—–,.:;'"-]+|[\s—–,.:;'"-]+$/g, "").toLowerCase();
+      if (p.length >= MIN_FRAGMENT) out.add(p);
+    }
+  }
+  return [...out];
+}
+
+/**
+ * Does this ONE line instruct (or render) a standing self-identification opener?
+ *
+ * @param {string} line
+ * @param {string[]} fragments  from {@link deriveDisclosureFragments}
+ * @returns {boolean}
+ */
+export function isDisclosureInstruction(line, fragments = []) {
+  const raw = String(line || "");
+  if (!raw.trim()) return false;
+  // The invariant is exempt, unconditionally and first.
+  if (ASKED_SHAPE.test(raw)) return false;
+
+  const lc = raw.toLowerCase();
+  for (const f of fragments) {
+    if (f && f.length >= MIN_FRAGMENT && lc.includes(f)) return true;
+  }
+  // Shape rule, for a hand-written variant the policy never contained. All three
+  // must hold on the SAME line: the act of announcing, the nature being
+  // announced, and the agent as the subject. Two of the three is ordinary prose
+  // ("the directory badges every AI member"), and scrubbing that would be
+  // vandalism of a perfectly good seat file.
+  return ANNOUNCE_VERB.test(raw) && SELF_NATURE.test(raw) && SELF_REF.test(raw);
+}
+
+/**
+ * The note left in place of whatever was removed. It names the SHAPE of the
+ * removed instruction and never reproduces it — see the module header.
+ */
+export const SCRUB_NOTE =
+  "[One or more lines of seat-local text were removed here: they instructed a standing self-identification opener. " +
+  "That instruction is stale — it dates from a period when the send gate demanded the line from internal recipients too " +
+  "(policies/ai-disclosure.yaml scopes the duty to an external first contact, and the send gate, not you, decides when it applies). " +
+  "The self-presentation rules elsewhere in this prompt are the current instruction and outrank any seat-local text. " +
+  "Answering honestly when someone sincerely asks whether you are an AI is unaffected and still required.]";
+
+/**
+ * Remove self-identification instructions from a block of seat-local prose.
+ *
+ * @param {string} text
+ * @param {string[]} fragments
+ * @returns {{ text: string, removed: string[] }} scrubbed text and the lines dropped
+ */
+export function scrubDisclosureInstructions(text, fragments = []) {
+  const src = String(text || "");
+  if (!src) return { text: src, removed: [] };
+  const kept = [];
+  const removed = [];
+  for (const line of src.split("\n")) {
+    if (isDisclosureInstruction(line, fragments)) { removed.push(line); continue; }
+    kept.push(line);
+  }
+  if (removed.length === 0) return { text: src, removed };
+  // Collapse the hole the removal left, then say that something was removed.
+  // Silence would be worse: a model that reads a truncated rule list has no way
+  // to tell an edit from an omission.
+  const body = kept.join("\n").replace(/\n{3,}/g, "\n\n").trim();
+  return { text: `${body}\n\n${SCRUB_NOTE}`, removed };
+}
+
+let _fragments = null;
+/**
+ * The fragments from the PACKAGED policy, cached per process.
+ * Never throws: an unreadable policy yields `[]`, which leaves the shape rule in
+ * {@link isDisclosureInstruction} doing the work on its own.
+ *
+ * @param {string} [policyPath]
+ * @returns {string[]}
+ */
+export function loadDisclosureFragments(policyPath = PACKAGED_POLICY) {
+  if (_fragments && policyPath === PACKAGED_POLICY) return _fragments;
+  let frags = [];
+  try {
+    frags = deriveDisclosureFragments(readFileSync(policyPath, "utf-8"));
+  } catch {
+    frags = [];
+  }
+  if (policyPath === PACKAGED_POLICY) _fragments = frags;
+  return frags;
+}
+
+/**
+ * The convenience wrapper the two prompt planes call: scrub seat-local prose
+ * against the packaged policy. Never throws.
+ *
+ * @param {string} text
+ * @returns {string}
+ */
+export function scrubSeatText(text) {
+  try {
+    return scrubDisclosureInstructions(text, loadDisclosureFragments()).text;
+  } catch {
+    return String(text || "");
+  }
+}

package/lib/identity/persona.mjs

@@ -10,9 +10,11 @@
  *     1. A freshly-scaffolded repo has "*Configured by `maestro setup`*" sitting
  *        in those sections. The model was handed a near-empty identity and fell
  *        back to the generic-assistant register it ships with — introducing and
- *        signing itself as "an AI assistant working on behalf of <principal>",
- *        deferring on matters inside its own mandate, and writing to colleagues
- *        as a support function rather than as the person holding the role.
+ *        signing itself with a rendering of the `identity_line` template in
+ *        policies/ai-disclosure.yaml (not reproduced here; see
+ *        SELF_PRESENTATION_RULES below for why), deferring on matters inside its
+ *        own mandate, and writing to colleagues as a support function rather
+ *        than as the person holding the role.
  *
  *     2. Everything the org actually knows about the member — title, seniority
  *        band, background, tone of voice, responsibilities, operating principles,
@@ -97,6 +99,62 @@ function reportingLine(a) {
   return title ? `You report to ${name}, ${title}.` : `You report to ${name}.`;
 }
 
+/**
+ * SELF-PRESENTATION — the rules about how an agent refers to its own
+ * nature. Kept as a standalone frozen list, and exported as a ready-made block,
+ * for one reason: they must reach the model on EVERY prompt plane, including the
+ * ones that render no persona block at all.
+ *
+ * WHY THAT MATTERS, concretely. `renderPersona` returns "" when config/agent.json
+ * carries neither a name nor a title, and the quick-reply plane
+ * (scripts/daemon/responder.mjs) rendered no persona block by design. Both cases
+ * handed the model an identity vacuum, and a model in an identity vacuum falls
+ * back to the generic-assistant register it ships with — which is how a rendering
+ * of the `identity_line` template in policies/ai-disclosure.yaml came to open a
+ * mid-thread correction to the agent's own figures, in the organisation's own
+ * channel, to colleagues who provisioned it. The template is NOT quoted here on
+ * purpose: a banned string reproduced in a comment is how the next author reads
+ * it in good faith and writes it back in, and
+ * scripts/daemon/no-unprompted-disclosure.test.mjs fails on it either way.
+ *
+ * The first rule is phrased against the OPENER specifically. "Do not describe
+ * yourself as an assistant" was already here and was obeyed literally and
+ * narrowly: the model did not *describe* itself in the body, it *announced*
+ * itself in the first line and considered the duty discharged.
+ *
+ * The third rule is the truthfulness invariant and is never traded for the
+ * other two. Removing an unprompted disclaimer is not the same as denying what
+ * you are, and `lib/comms/send-gate.screenDisclosure` still blocks any outbound
+ * that asserts the agent is not an AI, under every posture.
+ *
+ * The fourth rule exists because THE PROMPT IS NOT THE ONLY INSTRUCTION THE
+ * MODEL READS. The channel history handed to a reply is the strongest few-shot
+ * available to it, and on every seat that has already produced the opener, the
+ * agent's own prior posts are now sitting in that history as precedent in its
+ * own voice. Neither `lib/identity/disclosure-scrub` nor any prompt rule can
+ * remove them: the transcript is a record of what was said and rewriting it
+ * would be a worse fault than the opener. So the transcript is named explicitly
+ * and disqualified as a model, which is the only honest way to answer it.
+ */
+const SELF_PRESENTATION_RULES = Object.freeze([
+  "Do not open a message by announcing what you are. No standing identity line of any shape — no preamble naming your own nature, no line pairing your name with the person you work for, nothing before the content that exists only to flag what you are. Not on your first post in a channel, not mid-thread, not on a correction to your own figures. Every surface of this product already marks an AI member beside their name; a colleague reading you has seen it, so the line tells them nothing and reads as you disclaiming your own work before you have said anything.",
+  'Do not introduce, describe or sign yourself as an assistant, a bot, an AI helper, or as "working on behalf of" someone.',
+  "Being straight about what you are is not negotiable and does not conflict with either of the above: if someone sincerely asks whether they are dealing with an AI, say so plainly and without drama, then carry on. That is a direct answer to a direct question — not a standing disclaimer you attach to your own work. Where proactive disclosure IS owed (an external first contact) policies/ai-disclosure.yaml scopes it and the send-gate decides; it is never something you volunteer into an internal conversation.",
+  "Nothing in the transcript is a precedent for how to open. If an earlier message in this thread or channel opens with a standing identity line — including one you sent yourself, before this rule reached you — it is the mistake being corrected, not the house style. Do not match it, do not carry it forward for consistency, and do not repeat it because you are mid-conversation and it would look odd to stop.",
+]);
+
+/**
+ * The self-presentation rules as a prompt block, for planes that render no
+ * persona (scripts/daemon/responder.mjs's quick reply) or whose persona came
+ * back empty because the seat's config/agent.json is not filled in yet.
+ * Same text as the corresponding bullets inside the persona block — one source,
+ * so the two planes can never drift into saying different things.
+ */
+export const SELF_PRESENTATION = [
+  "How you refer to yourself:",
+  ...SELF_PRESENTATION_RULES.map((r) => `- ${r}`),
+].join("\n");
+
 /**
  * The voice rules — the behavioural half of the block, and the reason it exists.
  *
@@ -120,13 +178,17 @@ function voiceRules(a) {
     ? ` You report to ${pName} the way any senior colleague reports to their manager, and you do not preface your work with that fact.`
     : "";
 
+  const [noOpener, noSelfDescription, honesty, noPrecedent] = SELF_PRESENTATION_RULES;
+
   return [
     "You hold this role. Write as the person who holds it — with the judgement, standing and directness the title carries. You are a full member of this team, not a service attached to it.",
-    `Do not introduce, describe or sign yourself as an assistant, a bot, an AI helper, or as "working on behalf of" someone.${reportsClause}`,
+    noOpener,
+    `${noSelfDescription}${reportsClause}`,
     "Do not position yourself as junior to whoever you are writing to, including your principal or the CEO. State what you did, what you found, and what you recommend. Ask for a decision only when the decision is genuinely theirs to make.",
     "Do not thank people for their patience, apologise for taking up their time, or hedge a finding you are confident in. Colleagues at your level do not do this, and it reads as a tell.",
     "Disagree when you disagree, and say so first rather than burying it under agreement. A concern you soften into politeness is a concern you failed to raise.",
-    "Being straight about what you are is not negotiable and does not conflict with any of the above: if someone sincerely asks whether they are dealing with an AI, say so plainly and without drama. That is a direct answer to a direct question — not a standing disclaimer you attach to your own work.",
+    honesty,
+    noPrecedent,
   ];
 }
 
@@ -273,4 +335,77 @@ export function loadPersonaBlock(agentRoot, opts = {}) {
   }
 }
 
-export const _test = { ALTITUDE_STANDING, personaProse, reportingLine, voiceRules, list };
+/**
+ * Scaffold sentinels — a value the scaffold ships as "UNCONFIGURED…" asserts
+ * nothing, and rendering it puts a lie in the prompt. Treat it as absent so
+ * `renderPersona`'s omit-when-unset rule fires.
+ * @param {unknown} v
+ * @returns {string} "" for an unset or sentinel value
+ */
+export function configuredStr(v) {
+  const t = typeof v === "string" ? v.trim() : "";
+  if (!t) return "";
+  if (/^unconfigured\b/i.test(t)) return "";
+  return t;
+}
+
+/** Strip scaffold sentinels out of a parsed config/agent.json. @param {object} a @returns {object} */
+export function scrubAgentConfig(a) {
+  const src = a && typeof a === "object" ? a : {};
+  const out = { ...src };
+  for (const k of ["firstName", "lastName", "fullName", "title", "company", "companyDescription", "persona", "background", "bio"]) {
+    if (k in out) out[k] = configuredStr(out[k]);
+  }
+  // A surname with no first name and no full name is not an identity — better
+  // to render no name at all than "You are AGENT." (the scaffold ships
+  // firstName "UNCONFIGURED" / lastName "AGENT").
+  if (!out.firstName && !out.fullName) out.lastName = "";
+  if (src.principal && typeof src.principal === "object") {
+    const p = { ...src.principal };
+    for (const k of ["firstName", "lastName", "fullName", "title"]) p[k] = configuredStr(p[k]);
+    out.principal = p;
+  }
+  return out;
+}
+
+/** Same, for a parsed config/company.json. @param {object} c @returns {object} */
+export function scrubCompanyConfig(c) {
+  const src = c && typeof c === "object" ? c : {};
+  const out = { ...src };
+  for (const k of ["name", "legalName", "description", "tagline", "industry", "stage"]) {
+    if (k in out) out[k] = configuredStr(out[k]);
+  }
+  return out;
+}
+
+/**
+ * Render the persona block for a SEAT — config/agent.json + config/company.json
+ * with scaffold sentinels scrubbed first, so an unconfigured field is OMITTED
+ * rather than asserted.
+ *
+ * Lives here rather than in scripts/daemon/prompt-builder.mjs because BOTH
+ * prompt-assembly paths need it and only one of them had it. The quick-reply
+ * responder used to build its identity by scraping `## Identity` out of the
+ * seat's CLAUDE.md, which on every seat is the scaffold template — unresolved
+ * `{{agent.fullName}}` tokens followed by "If those tokens are still
+ * unresolved, your identity has not been configured yet". That is precisely the
+ * condition this module's header documents as producing an agent that
+ * introduces and signs itself with a rendering of the policy's identity_line,
+ * and it reached every reactive reply the fleet sent.
+ *
+ * @param {string} root agent repo root
+ * @param {object} [opts] forwarded to renderPersona
+ * @returns {string} "" when nothing is configured
+ */
+export function renderSeatPersona(root, opts = {}) {
+  const read = (rel) => {
+    try { return JSON.parse(readFileSync(join(root, rel), "utf-8")); } catch { return {}; }
+  };
+  try {
+    return renderPersona(scrubAgentConfig(read("config/agent.json")), scrubCompanyConfig(read("config/company.json")), opts) || "";
+  } catch {
+    return "";
+  }
+}
+
+export const _test = { ALTITUDE_STANDING, personaProse, reportingLine, voiceRules, list, SELF_PRESENTATION_RULES };