@cohortapp/agent-sdk 2.9.1 → 2.11.0

package/lib/org/ui-parity.test.mjs

@@ -1,7 +1,7 @@
 /**
  * ui-parity.test.mjs — Agent UI-parity helpers (full human-action mirror).
  *
- * The 359 wrappers in ui-parity.mjs are each a one-liner over call() from
+ * The 360 wrappers in ui-parity.mjs are each a one-liner over call() from
  * client.mjs, so client.test.mjs already proves the transport contract (headers,
  * idempotency, fail-open, frame normalisation). Here we just prove a representative
  * slice across families ROUTES to the correct method name, POSTs the params body,
@@ -326,7 +326,7 @@ test("a human-gated directory verb surfaces the server's refusal verbatim, never
   assert.match(frame.error.message, /human/);
 });
 
-test("every desk protocol method has exactly one ui-parity wrapper (196 desks / 359 total)", async () => {
+test("every desk protocol method has exactly one ui-parity wrapper (196 desks / 373 total)", async () => {
   const fs = await import("node:fs");
   const path = await import("node:path");
   const url = await import("node:url");
@@ -340,7 +340,15 @@ test("every desk protocol method has exactly one ui-parity wrapper (196 desks /
   // NONE of calling's 22 — so the huddle control, the calendar Join, host
   // mute/lock/remove, hand-raising and in-call chat had no wrapper at all.
   // +9 messaging +22 calling → 328 → 359.
-  assert.equal(called.length, 359, "one call() site per wrapper");
+  // 2026-08 voice delta: messaging.synthesizeVoiceNote — the agent-plane twin
+  // of the composer's hold-to-record button, which the messaging family had no
+  // wrapper for at all → 360.
+  // 2026-08 mandate delta: the whole accountability spine (11 methods) was
+  // protocol-declared and wrapped nowhere, so `lib/mandate/refresh.mjs` reached
+  // it by spelling the method name out as a string constant of its own → 371.
+  // 2026-08 preference delta: hq built `preference.*` FOR this plane (its own
+  // handler docblock says so) and the SDK wrapped neither half → 373.
+  assert.equal(called.length, 373, "one call() site per wrapper");
   assert.equal(new Set(called).size, called.length, "no duplicate method bindings");
   // The two conversation families are now WHOLE, which is what makes the
   // module docblock's claim true rather than aspirational.
@@ -348,8 +356,11 @@ test("every desk protocol method has exactly one ui-parity wrapper (196 desks /
     const famMethods = Object.entries((await import("./protocol.mjs")).METHODS)
       .filter(([, d]) => d.family === fam)
       .map(([n]) => n);
-    const unwrapped = famMethods.filter((m) => !new Set(called).has(m));
-    assert.deepEqual(unwrapped, [], `every ${fam}.* method is wrapped`);
+    // Whole MINUS the declared daemon-internal exceptions (the same ledger the
+    // sibling test enforces) — e.g. messaging.electResponder is the daemon's
+    // responder-election transport, not a human-app verb.
+    const unwrapped = famMethods.filter((m) => !new Set(called).has(m) && !DELIBERATELY_UNWRAPPED.has(m));
+    assert.deepEqual(unwrapped, [], `every ${fam}.* method is wrapped or declared daemon-internal`);
   }
   const p = await import("./protocol.mjs");
   const deskFams = new Set(["books", "calendar", "crm", "directory", "files"]);
@@ -398,6 +409,11 @@ const DELIBERATELY_UNWRAPPED = new Map([
   ["integration.listAgentTools", "runtime toolset plane (daemon poll)"],
   ["integration.invokeTool", "runtime toolset plane (executor)"],
   ["meetings.record", "knowledge plane writer, not the desk verb"],
+  // The responder-election plane: the daemon asks hq who — if anyone — should
+  // answer an undirected channel message. Server-decided and daemon-driven
+  // (scripts/daemon/agent-daemon.mjs, via lib/org/client.electResponder); a human
+  // never elects a responder, so there is no human-app verb to wrap.
+  ["messaging.electResponder", "responder-election plane — daemon-driven (client.electResponder)"],
 ]);
 
 test("the claimed families are wrapped WHOLE, minus a declared, self-cleaning exception list", async () => {
@@ -415,7 +431,8 @@ test("the claimed families are wrapped WHOLE, minus a declared, self-cleaning ex
     "escalation", "annotation", "contact", "file", "memory", "compact",
     "notification", "decision", "messaging", "calling", "board", "invitation",
     "user", "settings", "billing", "org", "integration", "email", "artifact",
-    "books", "calendar", "crm", "directory", "files",
+    "books", "calendar", "crm", "directory", "files", "meetings", "mandate",
+    "preference",
   ];
   const undeclared = [];
   for (const name of Object.keys(p.METHODS)) {
@@ -437,5 +454,107 @@ test("the claimed families are wrapped WHOLE, minus a declared, self-cleaning ex
   assert.deepEqual(notMethods, [], "these are not protocol methods — delete their exception lines");
 
   // And the docblock's own numbers stay honest.
-  assert.equal(wrapped.size, 359, "the docblock's wrapper count");
+  assert.equal(wrapped.size, 373, "the docblock's wrapper count");
+});
+
+/**
+ * THE FAMILIES THIS MODULE DOES NOT CLAIM, and who carries each instead.
+ *
+ * The guard above is airtight INSIDE `CLAIMED` and blind at its edge: it walks
+ * the protocol table and `continue`s on any family not in the list, so a NEWLY
+ * DECLARED family lands wrapped by nobody and fails no test. That is not
+ * hypothetical — genesis, subagent and mandate all arrived dark in one
+ * fortnight and were found by a census, not by CI.
+ *
+ * So every family in `METHODS` must now appear either in `CLAIMED` or here,
+ * with the surface that actually carries it. Two entries deliberately record a
+ * REFUSAL rather than a home, and two record a genuine hole; that is the point
+ * of a ledger — the honest answer is allowed, silence is not.
+ */
+const UNCLAIMED_FAMILIES = new Map([
+  // The org spine: named wrappers live in client.mjs beside the transport they
+  // use, and predate this module. Moving them would break every importer.
+  ["approval", "client.mjs approvalRequest/Resolve/Get/List + lib/org/approvals.mjs; curated approval_request/approval_wait"],
+  ["branding", "client.mjs (said in this module's own docblock); curated design_* tools"],
+  ["contacts", "client.mjs contactsUpsert — the knowledge plane's contact writer"],
+  ["cost", "client.mjs costReport + lib/org/cost-sync.mjs"],
+  ["credential", "client.mjs credentialPut/Lease/List/Revoke + lib/org/keys.mjs — a secret broker, not a pane"],
+  ["governance", "client.mjs governanceStatus/setDecisionRights — the §0.4 control plane"],
+  ["handoff", "client.mjs + lib/org/handoff.mjs — governance-gated delegation"],
+  ["knowledge", "client.mjs + lib/org/knowledge.mjs; curated knowledge_search/knowledge_append"],
+  ["lease", "client.mjs + lib/org/leases.mjs — the work kernel's lock primitive"],
+  ["policy", "client.mjs policyPublish + lib/org/policy.mjs"],
+  ["presence", "client.mjs presenceBeat + lib/org/registry.mjs — the daemon's own heartbeat"],
+  ["registry", "client.mjs register/heartbeat + lib/org/registry.mjs — enrolment, not a click"],
+  ["pairing", "client.mjs pairRequest — PRE-AUTH, deliberately off the authenticated call() path"],
+  ["agent", "agent.wait is the long-poll TRANSPORT rung (lib/org/push.mjs DEFAULT_WAIT_PATH), not a surface"],
+  // The registry family has a home with state a thin wrapper would silently
+  // lose. Reads reach a session through the curated subagent_* tools.
+  ["subagent", "lib/subagents/client.mjs — owns the offline outbox + lock file; curated subagent_list/get/resolve for the reads"],
+  // The venture-deliverable catalogue (2026-08). Its maestro surface is the
+  // CURATED table, not a thin one-liner per method: the eight `resource_*` desk
+  // tools are GENERATED from hq's own desk declaration and parity-tested
+  // against it, because hand-copying a desk table is precisely what produced
+  // the 239-ops-vs-69-tools drift this wave exists to stop. A hand-written
+  // wrapper here would be a third copy of the same eight names.
+  ["resource", "lib/org/tool-surface.mjs — curated resource_* desk tools, GENERATED from hq's desk declaration (never hand-copied) and parity-tested against it"],
+  // REFUSALS, not gaps. hq's `requireGenesisSeat` throws UNAUTHORIZED on any
+  // actor whose kind is not "human" (src/server/methods/genesis/_shared.ts),
+  // and architecture.* imports that same gate. A Genesis run belongs to
+  // (orgId, startedById) — one workspace AND one person — and an api-key
+  // principal is neither. Wrappers here would be dead code that always 401s,
+  // which is a worse surface than an honest absence.
+  ["genesis", "hq refuses every non-human actor (requireGenesisSeat) — unreachable from a bearer key by design"],
+  ["architecture", "same gate as genesis (it imports requireGenesisSeat) — unreachable from a bearer key by design"],
+  // HOLES, recorded as holes. Both are admin-scope writes with no SDK caller
+  // today; neither is reachable below the CEO tier even through org_rpc.
+  ["admin", "GAP — the deactivate/reactivate kill switch has no wrapper and no tool; admin scope, operator console only"],
+  ["hierarchy", "GAP — hierarchy.set (admin scope) has no wrapper; reporting edges are set in hq's own org chart today"],
+]);
+
+test("every protocol family is CLAIMED or has a written line saying who carries it", async () => {
+  const p = await import("./protocol.mjs");
+
+  // Kept in step with the guard above by construction: read the same list.
+  const CLAIMED = new Set([
+    "charter", "member", "team", "channel", "persona", "profile", "sop",
+    "escalation", "annotation", "contact", "file", "memory", "compact",
+    "notification", "decision", "messaging", "calling", "board", "invitation",
+    "user", "settings", "billing", "org", "integration", "email", "artifact",
+    "books", "calendar", "crm", "directory", "files", "meetings", "mandate",
+    "preference",
+  ]);
+
+  const families = new Set(Object.values(p.METHODS).map((d) => d.family));
+  const undeclared = [...families]
+    .filter((f) => !CLAIMED.has(f) && !UNCLAIMED_FAMILIES.has(f))
+    .sort();
+  // If this fails, a family was added to protocol.mjs and nothing on this plane
+  // noticed. Wrap it (and add it to CLAIMED), or add an UNCLAIMED_FAMILIES line
+  // naming the surface that carries it. "It's reachable via org_rpc" is not an
+  // answer: org_rpc is access:"admin" and does not exist below the CEO tier.
+  assert.deepEqual(undeclared, [], "every protocol family is claimed or declared");
+
+  // Self-cleaning: a declared family that has since been claimed, or that is no
+  // longer a protocol family at all, must lose its line rather than rot.
+  const nowClaimed = [...UNCLAIMED_FAMILIES.keys()].filter((f) => CLAIMED.has(f));
+  assert.deepEqual(nowClaimed, [], "these are claimed now — delete their ledger lines");
+  const gone = [...UNCLAIMED_FAMILIES.keys()].filter((f) => !families.has(f));
+  assert.deepEqual(gone, [], "these are not protocol families — delete their ledger lines");
+
+  // The two CLAIMED lists must stay identical, or one guard silently narrows.
+  const src = (await import("node:fs")).readFileSync(
+    (await import("node:path")).join(
+      (await import("node:path")).dirname(
+        (await import("node:url")).fileURLToPath(import.meta.url),
+      ),
+      "ui-parity.test.mjs",
+    ),
+    "utf8",
+  );
+  const blocks = [...src.matchAll(/const CLAIMED = (?:new Set\()?\[([\s\S]*?)\]/g)].map((m) =>
+    [...m[1].matchAll(/"([a-z]+)"/g)].map((x) => x[1]).sort().join(","),
+  );
+  assert.equal(blocks.length, 2, "both guards declare a CLAIMED list");
+  assert.equal(blocks[0], blocks[1], "the two CLAIMED lists must not drift apart");
 });

package/lib/tool-definitions.js

@@ -30,6 +30,11 @@
  */
 
 import { getOrgTools, loadIntegrationToolsFromDisk } from "./org/tool-surface.mjs";
+// The tool-side twin of normalizeAccessLevel below. Exact string equality used to
+// drop any entry whose `access` was missing or mis-cased out of EVERY tier —
+// see lib/org/tool-access.mjs for why that is the same footgun, on the other
+// side of the same comparison.
+import { partitionByAccess } from "./org/tool-access.mjs";
 
 // ============================================================================
 // 1. COMMUNICATION TOOLS
@@ -573,8 +578,24 @@ const generateReport = {
 const ORG_TOOL_DEFS = getOrgTools({}).filter((t) => !t.integration);
 const asClaudeTool = ({ name, description, input_schema }) => ({ name, description, input_schema });
 const orgTools = ORG_TOOL_DEFS.map(asClaudeTool);
-const orgToolsByAccess = (access) =>
-  ORG_TOOL_DEFS.filter((t) => t.access === access).map(asClaudeTool);
+
+// EXHAUSTIVE partition — every curated tool lands in exactly one tier.
+//
+// This replaces three independent `filter(t => t.access === x)` passes, which
+// silently agreed to drop any entry they all disagreed with: a tool whose
+// `access` was absent or mis-cased ("Read", " write ") matched no bucket and
+// therefore reached NO native access level — not ceo, not leadership, not
+// voice, not default — while the MCP plane kept publishing it, because
+// lib/mcp/server.mjs reads `access` only to set `readOnlyHint`. A capability
+// could be fully built, fully tested and invisible on this plane alone, with
+// nothing anywhere saying so. That is the same silent UNDER-privilege footgun
+// `normalizeAccessLevel` (below) was written to kill on the CALLER's side of
+// the very same string comparison, left unfixed on the TOOL's side.
+// partitionByAccess normalises casing and sends a genuinely unrecognised tier
+// to the most-restricted bucket with a loud warning: fail closed, fail noisy,
+// never fail invisible.
+const ORG_TOOLS_BY_TIER = partitionByAccess(ORG_TOOL_DEFS);
+const orgToolsByAccess = (access) => (ORG_TOOLS_BY_TIER[access] || []).map(asClaudeTool);
 
 /**
  * The workspace's GRANTED integration tools (SP5), read FRESH from the shared

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cohortapp/agent-sdk",
-  "version": "2.9.1",
-  "description": "Cohort Agent SDK \u2014 autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
+  "version": "2.11.0",
+  "description": "Cohort Agent SDK — autonomous AI colleague runtime. Deploy senior AI colleagues on dedicated Mac minis, wired to the Cohort operating surface.",
   "type": "module",
   "bin": {
     "agent-sdk": "./bin/maestro.mjs",

package/plugins/maestro-skills/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
     {
       "name": "maestro-skills",
       "source": "./",
-      "description": "Maestro operational skills — executive briefings, communications, hiring, strategy, org-desk workflows (mail, files, calendar, CRM, books, directory, design) and Cohort call working sessions."
+      "description": "Maestro operational skills — executive briefings, communications, hiring, strategy, org-desk workflows (mail, files, calendar, CRM, books, directory, design, venture deliverables) and Cohort call working sessions."
     }
   ]
 }

package/plugins/maestro-skills/plugin.json

@@ -131,6 +131,10 @@
       "name": "brand-steward",
       "description": "Work the org's Design section — read the brand foundation and voice, rewrite copy in that voice, render and export templates and the brand kit, regenerate stale imagery within a budget, and propose reviewable foundation changes. Use before writing anything the workspace publishes, to produce a branded asset, or when imagery/templates have gone stale."
     },
+    {
+      "name": "venture-deliverables",
+      "description": "Work the venture's deliverable catalogue — the cards a founder actually sends an investor (deck, one-pager, film, site, data room), their order, their provenance, and their link to the workspace drive. Use to answer \"what have we produced\", to file or correct a deliverable after producing one, to re-sort what an outsider sees first, or to point a card at the file you just wrote."
+    },
     {
       "name": "call-working-sessions",
       "description": "Turn a Cohort call into a working session — present a doc/sheet/channel/board/charter on the call stage, step through it (scroll/highlight/type), live-edit docs while talking, read what participants see on screen, and watch reactions and raised hands. Use when you are a participant in a live Cohort call and want to show rather than tell, walk people through a document, or ground \"this chart / that number\" talk in what is actually on screen."

package/plugins/maestro-skills/skills/venture-deliverables.md

@@ -0,0 +1,176 @@
+---
+name: venture-deliverables
+description: Work the venture's deliverable catalogue — the cards a founder actually sends an investor (deck, one-pager, film, site, data room), their order, their provenance, and their link to the workspace drive. Use to answer "what have we produced", to file or correct a deliverable after producing one, to re-sort what an outsider sees first, or to point a card at the file you just wrote.
+---
+
+# Venture Deliverables
+
+`/resources` is the venture's own catalogue: one card per artifact the venture
+has produced — deck, one-pager, film, site, data room, brand kit. It is not a
+folder and not an inbox. It is the short list a founder sends an investor, and
+the order of it is the order they are asked to look in.
+
+Until this family shipped, no agent could see it. Colleagues could write a deck
+and had no way to say the venture *had* one. That is the gap these eight tools
+close: `resource_list` / `resource_get` (every seat, including least-privilege
+ones), and `resource_create` / `resource_update` / `resource_delete` /
+`resource_reorder` / `resource_attach_file` / `resource_detach_file` (an
+EDITOR-equivalent seat). All of it is `executeOrgTool` — fail-open frames, never
+a throw.
+
+## Read it before you claim anything about it
+
+```bash
+node --input-type=module -e '
+import { executeOrgTool } from "./lib/org/tool-surface.mjs";
+const res = await executeOrgTool("resource_list", { limit: 200 });
+for (const r of res.ok ? res.result.resources : [])
+  console.log(r.sortOrder, r.slug, `[${r.kind}]`, r.source, r.fileId ?? "-", r.url);
+'
+```
+
+The order you get back is byte-identical to the order a human sees at
+`/resources` — same `sortOrder asc, createdAt asc`. Quote it as-is; a
+re-derivation can only disagree with the page.
+
+## Provenance decides whether your edit survives
+
+`source` is the single most load-bearing field on a card, and no schema can tell
+you why:
+
+- **`ftlab-portal`** — pushed from the venture portal and **re-upserted on its
+  natural key on every push**. Your delete comes back. Your retitle is
+  overwritten. If a portal card is wrong, the fix is upstream in the portal, not
+  here; correcting it here buys you the time until the next push and no longer.
+- **`genesis`** — laid down when the venture was stood up.
+- **`manual`** — created through this desk. These are the ones that are actually
+  yours to own.
+
+You cannot set `source` yourself. `resource_create` always stamps `manual`, so a
+card an agent made can never masquerade as portal-provenance. And `create` is
+**not** an upsert: an existing slug answers `CONFLICT` rather than quietly
+overwriting a portal row whose slug you guessed. Correct with `resource_update`.
+
+## Filing a deliverable you just produced
+
+Two steps, in this order — the card is the claim, the file is the object.
+
+```bash
+node --input-type=module -e '
+import { executeOrgTool } from "./lib/org/tool-surface.mjs";
+const made = await executeOrgTool("resource_create", {
+  kind: "one-pager",
+  title: "Seed one-pager — Aug 2026",
+  description: "Two-page summary for warm intros. Supersedes the June version.",
+  url: "https://acme.vc/one-pager.pdf",
+});
+console.log(made.ok ? made.result.resource.slug : made.error);
+'
+```
+
+Then, if the artifact is also filed in the workspace drive (the artifact ingest
+does this automatically for portal-crossed artifacts), cite it:
+`resource_attach_file { slug, fileId }`. Leave `setUrl` at its default `false` —
+a deck, one-pager or film keeps its public URL because the venture's own site
+and outreach link that object, and rewriting it to `/files/<id>` breaks those
+links. Pass `setUrl:true` only when the in-app file genuinely *is* the
+destination.
+
+Write the `description` like it will be searched, because it will be: hq indexes
+each card into the org's shared recall with the URL inside the summary text. A
+card described as "deck" is findable by nobody; "Seed deck, 14 slides, used in
+the Sept partner meetings" is.
+
+## The catalogue is an index, not a drive
+
+A card **cites** a file; a `WorkspaceFile` **is** one. `resource_*` returns the
+card's own columns and a `fileId` — never bytes, name, size, version or share
+list. That is a share boundary, not tidiness: the catalogue is org-wide, the
+drive is seat-scoped, so a resource tool that re-served file content would be a
+one-call way around the drive's own share filter.
+
+So: read the card here, read the **object** with `files_get` / `files_doc_read` /
+`org_rpc files.exportRequest`. If the drive answers `NOT_FOUND` on a `fileId` a
+card carries, that is the honest answer — either the file was swept or your seat
+is not shared on it, and those two are deliberately indistinguishable. Ask for
+the share; do not route around it, and do not report "the deliverable is
+missing" when what you hit was an ACL.
+
+## Re-sorting is total, and the refusal is the feature
+
+`resource_reorder` takes **every** slug in the workspace, exactly once. Anything
+else is a `CONFLICT` that names the missing / unknown / duplicated slugs back to
+you.
+
+```bash
+node --input-type=module -e '
+import { executeOrgTool } from "./lib/org/tool-surface.mjs";
+const cur = await executeOrgTool("resource_list", { limit: 200 });
+const slugs = cur.result.resources.map((r) => r.slug);
+const first = "film-founder-story";
+const res = await executeOrgTool("resource_reorder", {
+  slugs: [first, ...slugs.filter((s) => s !== first)],
+});
+console.log(res.ok ? res.result.resources.map((r) => r.slug) : res.error.message);
+'
+```
+
+List first, reorder from *that* list, and if it refuses, re-list rather than
+retrying: a `CONFLICT` means the catalogue changed under you — usually a portal
+push — and blind retry would scramble somebody's order. To nudge one card
+without touching the rest, use `resource_update { sortOrder }` instead.
+
+## Corrections without collateral damage
+
+`resource_update` **shallow-merges** `metadata` (`{...prior, ...patch}`), and a
+key you send as `null` is deleted. This matters more than it looks: the artifact
+ingest writes `sha256`, `runId`, `documentVersion`, `byteState` and `driveUrl`
+into that object, and if it were a whole-object replace, fixing a typo in a
+title would erase the delivery provenance of the artifact. Patch the keys you
+mean and leave the rest alone.
+
+Three fields are deliberately not editable, and it is worth knowing why before
+you go looking for them:
+
+- **`slug`** — it is both the ref and the portal's re-sync key. Renaming it would
+  orphan the upsert and produce a duplicate card on the next push.
+- **`fileId`** — re-pointing a card at a different drive row is its own audited
+  act: `resource_attach_file` / `resource_detach_file`.
+- **`source`** — provenance is the server's to assign.
+
+## Removing one
+
+`resource_delete` removes **the card only**. The `WorkspaceFile` it cited is not
+deleted, not even soft-deleted — the drive keeps its own 30-day recovery lane —
+which is why the reply carries `fileRetained: true`. Say that out loud when you
+report a deletion: "removed the card; the file is still in the drive" is the
+truth, and "deleted the deck" is not.
+
+`resource_detach_file` refuses with `CONFLICT` if the card's only destination is
+the file you are detaching, unless you supply a replacement `url`. A card that
+points nowhere is precisely the state this desk exists to prevent.
+
+## Rules of the desk
+
+- A card is a **claim the venture made this thing**. Never create one for an
+  artifact that does not exist yet, and never invent a `url` — if there is no
+  destination, there is no card.
+- `metadata` is free JSON with no secret column behind it. Never put a token,
+  key or signed URL in it. Only its *key names* ride the event chain; the values
+  are yours to keep honest.
+- A `FORBIDDEN` frame is your seat's scope, not a bug. Reads ride `org.read`
+  (every seat has it); the six writes ride `org.write` (EDITOR-equivalent). Ask
+  for the seat rather than working around it.
+- Cite cards to humans by **slug + title**, and say the `source` when you are
+  about to change something a portal push will undo.
+- Every write appends exactly one chain event, so a human can see what you did.
+  Write like that is true.
+
+## Notes
+
+- These tools register only when the vendored protocol carries the `resource`
+  family. `org_describe { family: "resource" }` lists the eight methods and their
+  scopes offline, with no credential.
+- The human surface for the same rows is `/resources`. If what you report and
+  what that page shows ever differ, the page is right and you have a bug —
+  `resource_list` is deliberately the same query in the same order.

package/policies/information-barriers.yaml

@@ -5,10 +5,23 @@
 # ─────────────────────────────────────────────
 # Domain Taxonomy
 # Used in provenance context_domain and profile boundaries
+#
+# THESE DESCRIPTIONS ARE EXECUTABLE, NOT DOCUMENTATION.
+#   scripts/daemon/context-compiler.mjs#loadDomainDescriptions regex-parses each
+#   `description:` string into the compiled prompt, and #buildDomainKeywords
+#   turns the same strings into the live keyword matcher that assigns a domain
+#   to an item. Every 4+-character word here is therefore a classification
+#   keyword on every deployment.
+#
+#   They must stay COMPANY-NEUTRAL. They previously named a specific (fictional)
+#   employer and a specific (fictional) joint-venture counterparty, so those two
+#   invented proper nouns were live classification keywords for every customer —
+#   matching nothing real, while the neutral words that should have matched were
+#   diluted. Describe the SHAPE of the information, never the name of a party.
 # ─────────────────────────────────────────────
 domains:
   internal-legal:
-    description: "Northwind's own legal strategy, GC advice, privilege-protected"
+    description: "The company's own legal strategy, general counsel advice, privilege-protected"
     default_sensitivity: high
   financial:
     description: "Cap table, runway, fundraising, financial planning"
@@ -23,19 +36,19 @@ domains:
     description: "Approach to regulators, gap assessments, remediation"
     default_sensitivity: high
   strategic-initiative:
-    description: "the strategic initiative M&A targets, deal terms, pipeline"
+    description: "Strategic initiative M&A targets, deal terms, pipeline"
     default_sensitivity: critical
   board-governance:
     description: "Board materials, resolutions, governance"
     default_sensitivity: high
   partner-operations:
-    description: "PartnerCo JV operational matters (shared domain)"
+    description: "Partner or joint-venture operational matters (shared domain)"
     default_sensitivity: low
   partner-commercial:
-    description: "PartnerCo commercial / revenue matters (shared domain)"
+    description: "Partner or joint-venture commercial and revenue matters (shared domain)"
     default_sensitivity: medium
   partner-internal:
-    description: "Northwind-side-only PartnerCo matters (negotiation position, internal JV strategy)"
+    description: "Company-side-only partner matters (negotiation position, internal joint-venture strategy)"
     default_sensitivity: high
   investor-relations:
     description: "Investor communications, fundraising pipeline"
@@ -106,8 +119,22 @@ assessment:
     medium: strip_and_send
     low: warn_and_send
   recent_context_hours: 48
-  unrestricted_recipients:
-    - alex-chen
+
+  # DEFAULT DENY. A slug listed here is granted blanket clearance across EVERY
+  # information domain — scripts/disclosure_boundaries.py#_build_clearance_summary
+  # renders "<name> has unrestricted access — all information domains are
+  # permitted" for them, and the assessment path treats them as unrestricted.
+  #
+  # It shipped populated with a fictional example recipient, which handed a
+  # person who exists in no customer's org a standing all-domains clearance on
+  # every deployment. Empty is the only safe shipped value, and it costs nothing:
+  # disclosure_boundaries.py already default-denies an undeclared domain.
+  #
+  # WIZARD STEP: `/init-maestro` may offer to populate this from
+  # config/agent.json `principal` — but ONLY after the operator explicitly
+  # confirms that person should bypass every barrier. Never populate it
+  # automatically, and never infer it from a contact list.
+  unrestricted_recipients: []
 
 # ─────────────────────────────────────────────
 # Audit Configuration