@cohortapp/agent-sdk 2.3.0

package/scripts/daemon/prompt-builder.mjs

@@ -0,0 +1,685 @@
+#!/usr/bin/env node
+// Prompt Builder — constructs focused prompts for claude --print sessions
+// Each inbox item or backlog queue item gets a tailored prompt with identity,
+// rules, context, and action instructions.
+
+import { readFileSync, readdirSync } from "fs";
+import { join } from "path";
+import { compileContext } from "./context-compiler.mjs";
+import { wrapExternalContent } from "../../lib/security/external-content.mjs";
+import { isEnabled as orgEnabled } from "../../lib/org/client.mjs";
+import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
+import { outcomeSourceShareable } from "./session-outcomes.mjs";
+
+const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
+
+// Load agent identity from canonical SOT for use in prompts and fallback preamble.
+function loadAgent() {
+  try {
+    return JSON.parse(readFileSync(join(AGENT_REPO_DIR, "config/agent.json"), "utf-8"));
+  } catch {
+    return { firstName: "Agent", fullName: "Agent", title: "agent", company: "the company", principal: { firstName: "principal", fullName: "the principal", title: "principal" } };
+  }
+}
+
+// Legacy: Maximum lines of conversation history (used when DAEMON_CONTEXT_COMPILER is off)
+const MAX_HISTORY_LINES = 30;
+
+// Org shared-knowledge injection (org enrollment). Bounded so a large recall can
+// never blow up the prompt: at most this many facts, each truncated.
+const ORG_RECALL_MAX_FACTS = 6;
+const ORG_RECALL_FACT_CHARS = 400;
+
+// Cached org config (config/org.yaml) — read once per process. null until loaded.
+let cachedOrgConfig;
+
+/**
+ * Load the org config (config/org.yaml) for the recall binding. Cached for the
+ * process. Returns {} on any error so callers can null-check uniformly — the org
+ * binding must never take down the daemon's main path.
+ */
+async function loadOrgConfig() {
+  if (cachedOrgConfig !== undefined) return cachedOrgConfig;
+  try {
+    const p = join(AGENT_REPO_DIR, "config/org.yaml");
+    const raw = readFileSync(p, "utf-8");
+    const m = await import("js-yaml");
+    const yaml = m && m.default ? m.default : m;
+    const doc = yaml.load(raw);
+    cachedOrgConfig = doc && typeof doc === "object" ? doc : {};
+  } catch {
+    cachedOrgConfig = {};
+  }
+  return cachedOrgConfig;
+}
+
+/** For tests: reset the cached org config so a fresh config/org.yaml is re-read. */
+export function _resetOrgConfigCache() {
+  cachedOrgConfig = undefined;
+}
+
+/**
+ * Derive a short recall query from the item/classification being processed.
+ * Prefers the classifier summary, then subject, then a slice of the body.
+ */
+function recallQueryFor(item, classResult, queueItem) {
+  const parts = [];
+  if (classResult && classResult.summary) parts.push(String(classResult.summary));
+  if (item && item.subject) parts.push(String(item.subject));
+  if (queueItem && queueItem.title) parts.push(String(queueItem.title));
+  if (parts.length === 0 && item && item.content) parts.push(String(item.content).slice(0, 200));
+  return parts.join(" — ").trim();
+}
+
+/**
+ * Render the org's shared knowledge as a clearly-delimited context block, or
+ * null when the integration is disabled / nothing relevant came back. Fail-open
+ * and bounded: never throws, caps the number and size of injected facts. The
+ * SERVER enforces ACL — we render exactly what recall() returns.
+ *
+ * @param {object} item inbox item (may be null for backlog)
+ * @param {object} classResult classifier output
+ * @param {object} queueItem backlog queue item (may be null)
+ * @returns {Promise<string|null>}
+ */
+async function buildOrgKnowledgeBlock(item, classResult, queueItem) {
+  try {
+    const cfg = await loadOrgConfig();
+    if (!orgEnabled(cfg)) return null;
+    const query = recallQueryFor(item, classResult, queueItem);
+    if (!query) return null;
+
+    const facts = await orgRecall(query, { cfg, limit: ORG_RECALL_MAX_FACTS });
+    if (!Array.isArray(facts) || facts.length === 0) return null;
+
+    const lines = ["--- ORG SHARED KNOWLEDGE ---"];
+    lines.push("Facts the org already knows that may bear on this item (ACL-filtered by the");
+    lines.push("server; treat as trusted internal context). Use them to inform your reply:");
+    let n = 0;
+    for (const f of facts) {
+      if (n >= ORG_RECALL_MAX_FACTS) break;
+      const textRaw = typeof f === "string" ? f : (f && (f.text || f.content || f.body) || "");
+      const text = String(textRaw).trim();
+      if (!text) continue;
+      const clipped = text.length > ORG_RECALL_FACT_CHARS ? `${text.slice(0, ORG_RECALL_FACT_CHARS)}…` : text;
+      const id = f && typeof f === "object" && f.id != null ? ` [${String(f.id)}]` : "";
+      lines.push(`- ${clipped}${id}`);
+      n += 1;
+    }
+    if (n === 0) return null;
+    lines.push("--- END ORG SHARED KNOWLEDGE ---");
+    return lines.join("\n");
+  } catch {
+    // Fail-open: org recall must never take down the prompt build.
+    return null;
+  }
+}
+
+// Cached identity preamble — extracted from CLAUDE.md on first call
+let cachedPreamble = null;
+
+function loadPreamble() {
+  if (cachedPreamble) return cachedPreamble;
+
+  try {
+    const raw = readFileSync(join(AGENT_REPO_DIR, "CLAUDE.md"), "utf-8");
+    cachedPreamble = extractPreamble(raw);
+  } catch (err) {
+    console.error(`[prompt-builder] Failed to read CLAUDE.md: ${err.message}`);
+    cachedPreamble = FALLBACK_PREAMBLE;
+  }
+  return cachedPreamble;
+}
+
+/**
+ * Extract the Identity, Operating Principles, Communication Rules,
+ * and Document Sharing sections from CLAUDE.md — keep it concise.
+ */
+function extractPreamble(raw) {
+  const sections = [];
+  const lines = raw.split("\n");
+  const targetHeaders = [
+    "## Identity",
+    "## Company Context",
+    "## Operating Principles",
+    "## Communication Rules",
+  ];
+
+  let capturing = false;
+  let depth = 0;
+
+  for (const line of lines) {
+    // Start capturing when we hit a target header
+    if (targetHeaders.some((h) => line.startsWith(h))) {
+      capturing = true;
+      depth = 2; // ## level
+      sections.push(line);
+      continue;
+    }
+
+    // Stop capturing when we hit another ## header that is NOT a sub-section of what we want
+    if (capturing && /^## [A-Z]/.test(line) && !targetHeaders.some((h) => line.startsWith(h))) {
+      capturing = false;
+      sections.push(""); // blank line separator
+      continue;
+    }
+
+    // Also stop at ### Document Sharing end — capture it but stop at next ##
+    if (capturing) {
+      sections.push(line);
+    }
+  }
+
+  const extracted = sections.join("\n").trim();
+
+  // If extraction got something reasonable, use it; otherwise fall back
+  if (extracted.length > 200) return extracted;
+  return FALLBACK_PREAMBLE;
+}
+
+// Generic preamble derived from config/agent.json. This is only used when
+// CLAUDE.md is unreadable; ordinarily the daemon pulls the full identity
+// block straight from the agent's CLAUDE.md.
+function buildFallbackPreamble() {
+  const a = loadAgent();
+  const principal = a.principal || {};
+  const principalName = principal.fullName || "the principal";
+  const principalTitle = principal.title || "principal";
+  return `You are ${a.fullName}, ${a.title} to ${principalName}, ${principalTitle} of ${a.company}.
+You operate as the autonomous executive command layer for the company.
+
+${a.companyDescription || a.company}.
+
+Operating Principles:
+1. Follow-through over brilliance — track every commitment until it closes
+2. Concise over comprehensive — sharp recommendations, not exhaustive reports
+3. Evidence over opinion — cite sources
+4. Bias to action — act decisively on operational matters; escalate only strategic commitments
+5. Audit everything — every action is logged
+6. Full autonomy, full accountability
+
+Autonomy Model:
+- ${a.firstName} sends autonomously: all internal messages, external operational messages, candidate comms, follow-ups, calendar coordination
+- ${a.firstName} escalates only: binding legal/financial obligations, regulatory submissions, acquisition deal terms, public statements
+
+Document Sharing (CRITICAL):
+- NEVER reference local file paths in outbound communications
+- Upload to Google Drive or generate branded PDF for sharing
+- Inline short content directly in messages
+- Never attach raw .md or .yaml files`;
+}
+const FALLBACK_PREAMBLE = buildFallbackPreamble();
+
+/**
+ * Proactive self-learning habit (WS3). Injected near the top of every reactive /
+ * backlog prompt so the agent treats skill-authoring as a normal reflex. The
+ * heavy lifting (the actual write + secret-scan + pruning) is autonomous and
+ * happens out-of-band in the Stop-hook reflect worker — this paragraph just
+ * sets the disposition.
+ */
+const SKILLS_GUIDANCE = [
+  "SELF-LEARNING: You can author your own Claude Code skills. When you work out a",
+  "repeatable, multi-step method that is likely to recur, prefer capturing it as a",
+  "skill (under plugins/agent-skills/) over re-deriving it next time — a future",
+  "session loads it automatically. Bias toward capturing the genuinely reusable",
+  "procedure; do NOT capture one-off steps, transient failures, or \"tool X doesn't",
+  "work\" claims. Skills are pruned automatically when they go stale, so capturing",
+  "is cheap and safe. To recall what you did before, the `session-search` skill",
+  "searches your own past sessions verbatim.",
+].join("\n");
+
+/**
+ * OUTCOME DISCIPLINE (parity with hq's meeting chair). A turn that decides things
+ * and commits to next steps must not leave them in a session log — nobody reads a
+ * session log, so the commitment is lost and the next turn re-decides it.
+ *
+ * This asks for ONE machine-readable block at the very end of the turn. The
+ * landing itself is DRIVEN, not left to the model: the daemon's post-session hook
+ * (scripts/daemon/session-outcomes.mjs) parses this block off the turn's final
+ * text and writes it through the org protocol (board.create + knowledge.append).
+ * So the model's only job is to be honest about what it committed to.
+ *
+ * Injected only when DAEMON_SESSION_OUTCOMES=1 (the same flag that arms the hook)
+ * AND the turn's source is org-visible (the same fail-closed gate the hook
+ * applies) — a landed outcome is readable by the whole org, so a private DM turn
+ * is neither asked for the block nor swept for one.
+ */
+const OUTCOME_DISCIPLINE = [
+  "OUTCOMES BLOCK (required, last thing in your reply):",
+  "End your turn with a block in exactly this shape:",
+  "",
+  "OUTCOMES:",
+  "- <the commitment, as a concrete next step> — owner: <name> — due: <when>",
+  "",
+  "Rules:",
+  "- List ONLY things that are genuinely committed to and NOT already done in this",
+  "  turn — a future action someone now owes. Work you completed here is not an",
+  "  outcome.",
+  "- `owner:` and `due:` are optional; include them only when they were actually",
+  "  stated. Never guess an owner.",
+  "- Most turns commit to nothing. When that is true, write `OUTCOMES: none` — an",
+  "  invented next step is worse than an empty block.",
+  "- Maximum 8 lines, one clause each, no sub-bullets.",
+  "- This block is machine-read and landed on the org board automatically; do not",
+  "  also create board items for the same commitments by hand, and do not mention",
+  "  the block in the message you send to the user.",
+].join("\n");
+
+const ACTION_INSTRUCTIONS = {
+  respond: `ACTION: Respond to this message.
+- Read the message carefully and understand the request
+- Check for any relevant context in thread history
+- Draft the substantive response directly — do NOT re-acknowledge if a holding message was already sent
+
+READING / CONTEXT (MCP tools are fine here):
+- Use MCP Slack for reading: \`mcp__claude_ai_Slack__slack_search_messages\`, \`slack_conversations_history\`, \`slack_users_info\`, etc.
+- Use MCP Gmail for reading: \`mcp__claude_ai_Gmail__gmail_search\`, \`gmail_read_email\`, etc.
+- Use MCP Google Calendar for scheduling lookups and event reads
+- These are authorised by the user session and are the preferred way to gather context before composing a reply
+
+SENDING (CLI scripts only — MCP writes will be blocked by pre-tool hooks):
+- Slack send: \`./scripts/slack-send.sh "<channel_id>" "<message_text>" --responding_to "<inbound_message_ts>"\`
+  - Add \`--thread_ts "<thread_ts>"\` if replying inside an existing thread
+  - The channel_id is in the inbox item as \`channel_id\` (starts with C, D, or G)
+  - Always pass \`--responding_to\` with the inbound message ts so dedup works
+- Gmail send: \`python3 scripts/send-email-threaded.py "<to>" "<subject>" "<body>" --reply-to-subject "<original_subject>"\`
+  - Use \`--attachment <path>\` to include files
+  - The \`From\` header and HTML signature are injected automatically
+- Workspace email (service \`orgmail\`) send: \`node scripts/org/send-orgmail.mjs --thread "<thread_id>" --body-file <path>\`
+  - NEVER raw curl and never the MCP \`email_send\` tool — this CLI is the sanctioned lane
+  - Recipients and subject derive from the thread server-side (reply rule); the thread_id is the inbox item's \`thread_id\`/\`channel_id\`
+  - A first-contact recipient returns approval_required — re-run with \`--request-approval --wait\` after a human approves in Cohort
+- SMS send: \`./scripts/send-sms.sh --to "<e164_number>" --body "<text>"\`
+- WhatsApp send: \`./scripts/send-whatsapp.sh --to "whatsapp:<e164_number>" --body "<text>"\`
+
+Why split read vs write: MCP tools are ideal for reading because they have full API coverage and the session is already authorised. But writes must go through the CLI scripts so the outbound message carries the agent's own User OAuth Token (xoxp-) and appears as the agent's Slack identity — not tagged as "Sent using @Claude". The pre-tool-use hook \`scripts/hooks/block-mcp-slack-send.sh\` will reject any attempt to call \`slack_send_message\` / \`slack_schedule_message\` / \`slack_send_message_draft\` and remind you to use the CLI. Gmail write hooks behave the same way, and \`scripts/hooks/block-mcp-cohort-send.sh\` blocks the org-MCP outbound writes (\`mcp__cohort__messaging_send\` / \`email_send\` / \`org_rpc\`).
+
+- Match the tone and urgency of the sender
+- If the sender is CEO, prioritise speed and directness
+- If you need to share documents, upload to Google Drive or send as PDF — NEVER reference local file paths
+- Verify the send succeeded by checking the script's exit code and stdout before considering the task complete`,
+
+  draft: `ACTION: Draft a response or document — do NOT send it yet.
+- Read the message and understand what is being requested
+- Draft the response or document
+- Save the draft to outputs/ with a descriptive filename
+- If it is a document (memo, brief, letter), use the appropriate format
+- Log that a draft has been created and is awaiting review`,
+
+  research: `ACTION: Research this topic and write findings.
+- Investigate the topic thoroughly using available tools and knowledge
+- Check relevant files in knowledge/, docs/, and memory/
+- Write concise findings to outputs/research/ with today's date prefix
+- Include sources and evidence for all claims
+- Highlight actionable recommendations`,
+
+  queue: `ACTION: Create a queue item for later processing.
+- This item needs tracking but not immediate action
+- Create or update a queue item in the appropriate state/queues/ file
+- Set appropriate priority, owner, SLA deadline, and next_action
+- Log the queuing decision`,
+
+  archive: `ACTION: Archive — no action needed.
+- Mark this item as processed
+- Log that it was reviewed and archived with a brief reason
+- No response required`,
+
+  ignore: `ACTION: Ignore — skip entirely.
+- This item requires no processing
+- Log only that it was classified as ignore`,
+};
+
+function today() {
+  return new Date().toISOString().split("T")[0];
+}
+
+/**
+ * Load recent conversation history for a sender/channel from interaction logs.
+ * Searches memory/interactions/slack/{channel-or-sender}/ for recent JSONL entries.
+ * Returns the most recent entries as formatted context text.
+ */
+function loadConversationHistory(item) {
+  if (!item) return null;
+  const date = today();
+
+  // Try multiple paths where interaction logs may live
+  const channelId = extractChannelId(item);
+  const senderSlug = item.sender ? item.sender.replace(/\s+/g, "-").toLowerCase() : null;
+
+  const candidateDirs = [];
+  if (channelId) candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", channelId));
+  if (senderSlug) {
+    candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", `dm-${senderSlug}`));
+    candidateDirs.push(join(AGENT_REPO_DIR, "memory", "interactions", "slack", senderSlug));
+  }
+
+  const entries = [];
+
+  for (const dir of candidateDirs) {
+    try {
+      // Read today's and yesterday's logs
+      const files = readdirSync(dir)
+        .filter((f) => f.endsWith(".jsonl"))
+        .sort()
+        .reverse()
+        .slice(0, 2); // Today + yesterday at most
+
+      for (const file of files) {
+        try {
+          const content = readFileSync(join(dir, file), "utf-8").trim();
+          if (!content) continue;
+          const lines = content.split("\n").filter(Boolean);
+          for (const line of lines) {
+            try {
+              entries.push(JSON.parse(line));
+            } catch { /* skip malformed lines */ }
+          }
+        } catch { /* skip unreadable files */ }
+      }
+    } catch { /* dir doesn't exist — try next */ }
+  }
+
+  if (entries.length === 0) return null;
+
+  // Sort by timestamp and take recent entries
+  entries.sort((a, b) => {
+    const tsA = a.ts || a.received_at || "";
+    const tsB = b.ts || b.received_at || "";
+    return tsA.localeCompare(tsB);
+  });
+
+  const recent = entries.slice(-MAX_HISTORY_LINES);
+
+  // Format into readable context
+  const lines = ["## Recent conversation history with this sender"];
+  for (const entry of recent) {
+    const from = entry.from || entry.user_name || entry.sender || "unknown";
+    const text = entry.content || entry.text || "(no text)";
+    const ts = entry.received_at || entry.processed_at || entry.ts || "";
+    const actions = entry.actions_taken
+      ? ` [Actions: ${Array.isArray(entry.actions_taken) ? entry.actions_taken.join(", ") : entry.actions_taken}]`
+      : entry.action_taken
+        ? ` [Action: ${entry.action_taken}]`
+        : "";
+    const responded = entry.response_sent ? " [Responded]" : "";
+    lines.push(`[${ts}] ${from}: ${text.substring(0, 300)}${actions}${responded}`);
+  }
+
+  return lines.join("\n");
+}
+
+/**
+ * Extract Slack channel ID from item metadata.
+ */
+function extractChannelId(item) {
+  if (!item) return null;
+  // Direct channel ID field
+  if (item.channel_id) return item.channel_id;
+  // From raw_ref format: "slack:D099N1JGKRQ:1775331885.690669"
+  if (item.raw_ref) {
+    const match = item.raw_ref.match(/slack:([DC][A-Z0-9]+):/);
+    if (match) return match[1];
+  }
+  // Channel field if it looks like an ID
+  if (item.channel && /^[DC][A-Z0-9]{8,}$/.test(item.channel)) return item.channel;
+  return null;
+}
+
+/**
+ * Build a sender identifier string for the prompt
+ */
+function formatSender(item) {
+  const parts = [];
+  if (item.sender) parts.push(item.sender);
+  if (item.sender_privilege && item.sender_privilege !== "unknown") {
+    parts.push(`(${item.sender_privilege})`);
+  }
+  return parts.join(" ") || "unknown sender";
+}
+
+/**
+ * Build the item context block for inbox items
+ */
+export function buildInboxContext(item) {
+  const lines = [];
+  lines.push("--- INCOMING MESSAGE ---");
+  lines.push(`From: ${formatSender(item)}`);
+  lines.push(`Service: ${item.service || "unknown"}`);
+  lines.push(`Channel: ${item.channel || "unknown"}`);
+  if (item.subject) lines.push(`Subject: ${item.subject}`);
+  lines.push(`Timestamp: ${item.timestamp || new Date().toISOString()}`);
+  if (item.is_reply) lines.push(`Is reply: yes`);
+  if (item.thread_id) lines.push(`Thread ID: ${item.thread_id}`);
+  if (item.raw_ref) lines.push(`Reference: ${item.raw_ref}`);
+  lines.push("");
+
+  const source = item.service || item.channel || "external";
+
+  if (item.thread_context) {
+    lines.push("Thread context:");
+    // Thread history is attacker-influenced; fence it as untrusted DATA (H2).
+    lines.push(wrapExternalContent(item.thread_context, { source }));
+    lines.push("");
+  }
+
+  lines.push("Message content:");
+  // The message body is the primary prompt-injection surface: inbound email/
+  // Slack/etc. text flows into a claude --print session. Fence it so an
+  // embedded "ignore previous instructions" arrives as data, not commands,
+  // and annotate a heuristic suspicion score. See lib/security/external-content.mjs.
+  lines.push(
+    item.content
+      ? wrapExternalContent(item.content, { source, annotateSuspicion: true })
+      : "(empty)"
+  );
+  lines.push("--- END MESSAGE ---");
+
+  return lines.join("\n");
+}
+
+/**
+ * Build the item context block for backlog queue items
+ */
+function buildBacklogContext(queueItem) {
+  const lines = [];
+  lines.push("--- QUEUE ITEM ---");
+  lines.push(`ID: ${queueItem.id || "unknown"}`);
+  lines.push(`Title: ${queueItem.title || "untitled"}`);
+  lines.push(`Status: ${queueItem.status || "open"}`);
+  lines.push(`Priority: ${queueItem.priority || "normal"}`);
+  lines.push(`Owner: ${queueItem.owner || loadAgent().firstName.toLowerCase()}`);
+  if (queueItem.source) lines.push(`Source: ${queueItem.source}`);
+  if (queueItem.source_ref) lines.push(`Source ref: ${queueItem.source_ref}`);
+  if (queueItem.due) lines.push(`Due: ${queueItem.due}`);
+  if (queueItem.sla_deadline) lines.push(`SLA deadline: ${queueItem.sla_deadline}`);
+  lines.push("");
+
+  if (queueItem.context) {
+    lines.push("Context:");
+    lines.push(queueItem.context);
+    lines.push("");
+  }
+
+  if (queueItem.next_action) {
+    lines.push("Next action required:");
+    lines.push(queueItem.next_action);
+    lines.push("");
+  }
+
+  if (queueItem.blocked_by) {
+    lines.push(`Blocked by: ${queueItem.blocked_by}`);
+    lines.push("");
+  }
+
+  if (queueItem.success_criteria) {
+    lines.push("Success criteria:");
+    if (Array.isArray(queueItem.success_criteria)) {
+      for (const c of queueItem.success_criteria) lines.push(`- ${c}`);
+    } else {
+      lines.push(queueItem.success_criteria);
+    }
+    lines.push("");
+  }
+
+  // Include recent history for context
+  if (queueItem.history && Array.isArray(queueItem.history) && queueItem.history.length > 0) {
+    const recent = queueItem.history.slice(-3);
+    lines.push("Recent history:");
+    for (const h of recent) {
+      lines.push(`  [${h.timestamp}] ${h.action} (by ${h.by || "unknown"})`);
+    }
+    lines.push("");
+  }
+
+  lines.push("--- END QUEUE ITEM ---");
+  return lines.join("\n");
+}
+
+/**
+ * Build a focused prompt for a claude --print session.
+ *
+ * @param {object} item - The inbox item (sender, content, channel, service, subject, thread_context, etc.)
+ * @param {object} classResult - Classifier output (priority, action, model, summary, category)
+ * @param {object} options - { type: "inbox" | "backlog", queueItem?: object }
+ * @returns {string} Prompt string ready for claude --print
+ */
+export async function buildPrompt(item, classResult, options = {}) {
+  const { type = "inbox", queueItem, holdingMessage } = options;
+  const preamble = loadPreamble();
+  const action = classResult.action || "respond";
+  const actionBlock = ACTION_INSTRUCTIONS[action] || ACTION_INSTRUCTIONS.respond;
+  const date = today();
+
+  const parts = [];
+
+  // 1. Identity preamble (cached)
+  parts.push(preamble);
+  parts.push("");
+
+  // 1b. Self-learning habit (WS3) — sets the disposition to capture reusable
+  // procedures as skills. Cheap, always-on; the autonomous write happens later
+  // in the Stop-hook reflect worker.
+  parts.push(SKILLS_GUIDANCE);
+  parts.push("");
+
+  // 1a. Holding message warning — TOP OF PROMPT so Claude sees it before action instructions.
+  // This is the most critical instruction in the prompt: prevents double-replies.
+  // We repeat it at section 7a as well, immediately before the action block.
+  if (holdingMessage) {
+    parts.push("===== STOP — READ THIS FIRST =====");
+    parts.push(`A HOLDING MESSAGE has ALREADY been sent to the sender by the daemon. The exact text was:`);
+    parts.push(`  "${holdingMessage}"`);
+    parts.push("");
+    parts.push("Your job is to deliver the FULL substantive response or complete the actual work — NOT to acknowledge again.");
+    parts.push("- Do NOT start your reply with 'Got it', 'On it', 'Looking into this', 'Will get back to you', 'Thanks for reaching out', or any similar acknowledgment phrase.");
+    parts.push("- Do NOT echo what the user asked — they already received the holding note confirming receipt.");
+    parts.push("- Open with the actual answer, the actual draft, or the actual finding. Be direct.");
+    parts.push("- If after investigation you still cannot deliver a substantive response and need more time, send a SECOND-LEVEL UPDATE (specific blocker, ETA, what you need from the user) — never a generic 'still looking into it'.");
+    parts.push("===== END WARNING =====");
+    parts.push("");
+  }
+
+  // 2. Session context
+  parts.push(`Date: ${date}`);
+  parts.push(`Classification: priority=${classResult.priority}, action=${action}, category=${classResult.category || "unclassified"}`);
+  parts.push(`Summary: ${classResult.summary || "No summary"}`);
+  parts.push("");
+
+  // 3. Item context — inbox or backlog
+  if (type === "backlog" && queueItem) {
+    parts.push(buildBacklogContext(queueItem));
+  } else {
+    parts.push(buildInboxContext(item));
+  }
+  parts.push("");
+
+  // 3b. Org shared knowledge (org enrollment). When config/org.yaml enables the
+  // Cohort plane, consult the org-wide ACL'd RAG source for this item's topic and
+  // inject what the fleet already knows. Fail-open + bounded: a disabled/unreachable
+  // server (or empty recall) injects nothing; the SERVER enforces ACL — we just
+  // render what recall() returns.
+  // When the compiled-context path is active it performs the org recall itself
+  // (context-compiler.mjs → loadOrgMemory), so skip here to avoid a duplicate
+  // recall + duplicated context in the same prompt. Backlog items pass their
+  // queueItem into compileContext (below) so entity coverage is preserved.
+  if (process.env.DAEMON_CONTEXT_COMPILER !== "1") {
+    const orgBlock = await buildOrgKnowledgeBlock(item, classResult, queueItem);
+    if (orgBlock) {
+      parts.push(orgBlock);
+      parts.push("");
+    }
+  }
+
+  // 4. Compiled context (profile + history + disclosure boundaries + active sessions + sent messages)
+  if (process.env.DAEMON_CONTEXT_COMPILER === "1" && (type === "inbox" ? item : true)) {
+    try {
+      const { contextBlock } = await compileContext(
+        item || {},
+        classResult,
+        { type, queueItem }
+      );
+      parts.push(contextBlock);
+      parts.push("");
+    } catch (err) {
+      console.error(`[prompt-builder] Context compilation failed: ${err.message}`);
+      // Fall through to legacy behaviour
+      if (type === "inbox" && item) {
+        const history = loadConversationHistory(item);
+        if (history) { parts.push(history); parts.push(""); }
+      }
+    }
+  } else if (type === "inbox" && item) {
+    // Legacy path (feature flag off)
+    const history = loadConversationHistory(item);
+    if (history) { parts.push(history); parts.push(""); }
+  }
+
+  // 5. Action instructions
+  // If a holding message was already sent, prepend a second reminder so the
+  // action block is unambiguous about not re-acknowledging.
+  if (holdingMessage) {
+    parts.push("REMINDER: A holding message was already sent (see top of prompt). The action below describes WHAT to do — but you must NOT begin your reply with another acknowledgment. Open with substance.");
+    parts.push("");
+  }
+  parts.push(actionBlock);
+  parts.push("");
+
+  // 6. User profile lookup — legacy only (when feature flag is off, profile is in compiled context)
+  if (process.env.DAEMON_CONTEXT_COMPILER !== "1" && type === "inbox" && item && item.sender) {
+    const profileName = item.sender.replace(/\s+/g, "-").toLowerCase();
+    parts.push(`Before responding, read memory/profiles/users/${profileName}.yaml for sender preferences, standing instructions, and relationship context. If the file does not exist, proceed without it.`);
+    parts.push("");
+  }
+
+  // 7. Backlog-specific: queue update instructions (with history dedup — ib-20260405-001)
+  if (type === "backlog" && queueItem) {
+    parts.push(`When this task is complete:
+- Update the queue item status to "resolved" in the appropriate state/queues/ file
+- HISTORY DEDUP RULE (CRITICAL): Before appending a history entry, read the item's existing history and check the LAST entry. If the last entry has substantially the same action text (same status, same priority, same blocked_by, same conclusion — e.g. "confirmed no changes", "still open", "re-verified"), do NOT append a new history entry. Instead, ONLY update the last_updated timestamp on the queue item. Only append a new history entry when something actually changed (status changed, new information, blocker resolved, action taken that differs from the last entry).
+- When you DO add a new history entry, include: timestamp, action taken, and by: agent-daemon
+- If the task cannot be completed, set status to "blocked" and record what is blocking it`);
+    parts.push("");
+  }
+
+  // 8. (Holding message warning is now at the TOP of the prompt — see section 1a.
+  //     A second reminder is injected before the action block in section 5.)
+
+  // 8b. Outcome discipline — ask for the machine-read OUTCOMES block so the
+  // post-session hook can land this turn's commitments on the org board. Gated by
+  // the same flag that arms the hook AND by the same fail-closed confidentiality
+  // gate the hook applies, so the block is only ever asked for on a turn whose
+  // commitments may actually become org-visible. Asking a private DM turn for a
+  // block that would then be discarded is just noise the user can see.
+  if (
+    process.env.DAEMON_SESSION_OUTCOMES === "1" &&
+    outcomeSourceShareable(item).shareable
+  ) {
+    parts.push(OUTCOME_DISCIPLINE);
+    parts.push("");
+  }
+
+  // 9. Audit instruction
+  parts.push(`Log all actions taken to logs/audit/${date}-actions.jsonl as a JSON line with: timestamp, action_type, target, result, session context.`);
+
+  return parts.join("\n");
+}