@inetafrica/open-claudia 2.11.0 → 2.12.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## v2.12.0
+- **Persona packs — the bot now adapts voice + scope to WHO it's talking to (Phase 2).** An entity note about a *person* is upgraded into a persona pack: the same file gains four optional sections — **Role** (what they do), **Style** (how to talk to them), **Knows** (what to assume vs explain), **Mandate** (for non-owners: what the bot may do/discuss on their behalf) — plus a `relationship: owner|trusted|external` frontmatter scalar. The upgrade is strictly **additive (risk R7)**: an ordinary entity with no persona data serializes **byte-identically** to before, so places/projects/orgs/systems are untouched. `core/entities.js` learns `PERSONA_SECTIONS`, `RELATIONSHIPS`, `normalizeRelationship`, an `emptySections()` backfill for notes written before the upgrade, and persona params on `upsertEntity` that each replace their section wholesale (like Notes). FTS indexes the descriptive sections (Role/Style/Knows) so a persona is matchable by content, but **Mandate is deliberately not indexed** — it's policy, not description, and must not surface a pack on an unrelated mention.
+- **Per-turn speaker persona, injected cache-safely (2.2).** `buildSpeakerPersonaBlock` resolves the *current* speaker (deterministically, not by keyword match) and injects their Role/Style/Knows — and, for a non-owner, their Mandate — so the model shapes its voice and scope every turn. It rides the **uncached dynamic tail** (risk R13), never `buildSystemPrompt`, so persona edits never bust the prompt-cache prefix, and dedupes once per (channel, session, entity-version) like packs/entities (a compaction or a persona edit re-injects). An **owner's Mandate is never injected** (the owner has no guardrails — injecting one would be noise).
+- **People ↔ persona binding (2.1).** `people.js` gains an `entitySlug` pointer (a person can point at a differently-named pack) with `setEntitySlug` + a pure `resolveEntitySlug` (explicit pointer, else slug-from-name); surfaced in `roster()`.
+- **Write-side population (2.3).** The post-turn reviewer (`pack-review.js`) and the nightly dream (`dream.js`) both learn to fill persona sections: their prompts describe the four sections + the relationship scalar with explicit guardrails ("never invent an owner mandate; never copy one person's guardrail onto another"), their JSON schemas carry the new fields, and their apply paths thread them into `upsertEntity` (each replacing its section wholesale; null/omit leaves it intact).
+- **Relationship-gated cross-conversation recall (2.4, risk R6).** Episodic recall reaches across conversations into the owner's project transcripts, so surfacing it to a non-owner is a cross-tenant leak. `episodesAllowedForSpeaker()` makes cross-conversation episodes **owner-only and fail-closed**: an unknown speaker or any resolution error suppresses episodes; only a positively-identified owner (or no speaker context at all — CLI/tests) pulls them. Same-conversation packs/entities are unaffected.
+- **Provenance stamps (2.5).** Appended Log/Journal lines from a **non-owner** contributor are stamped `(via <name>)` (the owner is the default author — tagging them would be noise), so a topic's history shows where an external/trusted colleague's contribution came from. Resolved from the live store at the reviewer call site (the reviewer applies in an async continuation) and threaded through as a `source`.
+- **Tests.** Four new hermetic suites, all wired into `npm test`: `test-persona-packs.js` (round-trip + R7 byte-identical ordinary entity + FTS mandate-exclusion), `test-speaker-persona.js` (owner-Mandate suppression, non-owner Mandate shown, dedupe + re-inject on edit, silent for no-persona/unknown speaker), `test-persona-pipeline.js` (reviewer + dream populate/refresh persona wholesale + provenance), `test-recall-relationship-gate.js` (owner allowed, non-owner/unknown blocked, no-context ungated). Full suite green.
+- **Agent-space / OpenClaw:** no new deps, no new required env; Docker image builds identically. Behaviour is inert until a person actually has persona data — existing deployments are unaffected until the reviewer/dream (or the owner, editing `entities/<slug>.md`) fills a pack. The independent **fail-closed enforcer** that hard-enforces Mandate at the outbound choke point is still Phase 3.
+
 ## v2.11.0
 - **Unified multi-channel identity is now LIVE by default (Phases 0 + 1).** v2.10.0 shipped the split-brain fix inert behind `OC_UNIFIED_IDENTITY` (default off). This release flips the default **on** and lands the Phase 1 queue-routing fix that made it safe to do so. The owner's Telegram, Kazee and voice channels now resolve to one canonical person out of the box — one state, one session, one transcript, one run-lock — so the bot stops fracturing into a separate assistant per channel. The flag stays as an operator **kill-switch** (`OC_UNIFIED_IDENTITY=0` + restart) for reversibility (risk R14); it is no longer a hold-back gate.
 - **Person-scoped queue routing (Phase 1, 1.2) — the blocker that kept the flag off.** Under unified identity the owner's channels share one run-lock and message queue, so a message sent from one channel while a run is in flight on another used to drain in the *finishing* turn's async scope — a Kazee follow-up could be answered in the Telegram chat. Each queued message now **captures its origin channel** at enqueue time, and `drainQueuedMessages` peels off one same-origin run at a time (requeuing the rest so the natural close→drain tail-recursion handles the next group), scoping each drained reply to `chatContext.run(origin, …)`. Replies always route back to the channel the message came from; same-origin batches behave exactly as before. Grouping logic extracted to a pure, unit-tested `core/queue-drain.js`.

package/core/dream.js

@@ -320,7 +320,7 @@ Your job — decide what consolidation, if any, is warranted:
 3. parents: assign an existing pack as parent of another (sub-topic relationship) without creating anything. NOTE: a separate deterministic pass already auto-files packs whose slug is a prefix-child of another (e.g. foo-bar under foo), so DON'T spend a parents op on those — reserve parents (and umbrellas) for semantic groupings the slug prefix can't catch (differently-named siblings of one theme).
 4. retag: tighten descriptions and tags. The router FTS-matches incoming messages against name/description/tags, so generic words there cause false matches. Descriptions should be one specific line; tags specific nouns.
 5. entity_merges: the same real-world entity recorded twice gets merged (the better slug wins).
-6. entity_notes: rewrite an entity's Notes to be current and cross-linked — mention related packs as [[pack-dir]] and related entities by name.
+6. entity_notes: rewrite an entity's Notes to be current and cross-linked — mention related packs as [[pack-dir]] and related entities by name. For a PERSON, this doubles as their persona pack: you may also consolidate role/style/knows (how to talk to them, what they know) and — for non-owners only — mandate (what the assistant may do/discuss on their behalf). Set relationship (owner|trusted|external) only if clearly established. Keep each persona field tight; never invent an owner mandate; never copy one person's guardrail onto another. Send only the fields you're changing; null/omit the rest.
 7. archive: retire packs that have gone cold — long unused AND rarely used over their life (consult last_used and the usage count). Archiving moves a pack out of the live index (reversibly, backed up) so it stops adding recall noise. ONLY propose packs idle ≥${ARCHIVE_IDLE_DAYS} days and used ≤${ARCHIVE_MAX_USAGE}× total; never an umbrella/parent pack that still has children; when in doubt, leave it. Give a one-line reason.
 8. lessons: keep the always-loaded lessons few and sharp — they cost context on EVERY turn. dedupe near-identical lessons (op "remove" the weaker, keep the better wording; or op "edit" to merge two into one tight line); tighten a clumsy lesson with op "edit". If the count exceeds the cap of ${lessons.MAX_LESSONS}, demote the weakest down to the cap — prefer lessons that are low-reinforced AND whose fact is safely captured in the pack named in their (src) (they will still surface by topic-match), and NEVER remove a frequently-reinforced lesson (those are actively preventing a repeat mistake). Even under the cap you may remove a lesson clearly redundant with its source pack that has stayed at 0 reinforcements for a long time, but be conservative — when in doubt, keep it. Reference lessons by their exact current text.
 9. persona: evolve the persona GENTLY — keep its structure and length (under 2200 chars), adjust only what recent work justifies (a new habit, a sharpened quirk). Most dreams should return null here.
@@ -341,7 +341,7 @@ Reply with ONLY a JSON object, no prose, no code fences:
  "parents": [{"pack": "<dir>", "parent": "<dir>"}],
  "retag": [{"pack": "<dir>", "description": "<one specific line>", "tags": ["..."]}],
  "entity_merges": [{"into": "<slug>", "from": ["<slug>"], "notes": "<merged Notes or null>"}],
- "entity_notes": [{"entity": "<slug>", "notes": "<rewritten Notes>"}],
+ "entity_notes": [{"entity": "<slug>", "notes": "<rewritten Notes or null>", "relationship": "<owner|trusted|external, people only, or null>", "role": "<people only, or null>", "style": "<people only, or null>", "knows": "<people only, or null>", "mandate": "<non-owner people only, or null>"}],
  "archive": [{"pack": "<dir>", "reason": "<one line: why it's cold>"}],
  "lessons": [{"op": "remove", "text": "<exact current lesson text>", "reason": "<duplicate of … / safely in pack … / cold>"}],
  "persona": null,
@@ -582,9 +582,17 @@ function applyDream(decision, backupRoot) {
   for (const en of decision.entity_notes || []) {
     try {
       const ent = en?.entity && !gone.has(en.entity) && entities.readEntity(en.entity);
-      if (!ent || typeof en.notes !== "string" || !en.notes.trim()) continue;
-      entities.upsertEntity({ name: ent.name, notes: en.notes });
-      lines.push(`🔗 Refreshed notes on ${ent.name}`);
+      if (!ent) continue;
+      // Persona-pack fields consolidate alongside Notes (people only). Each
+      // replaces its section wholesale when a non-empty string is supplied.
+      const persona = {};
+      for (const k of ["relationship", "role", "style", "knows", "mandate"]) {
+        if (typeof en[k] === "string" && en[k].trim()) persona[k] = en[k];
+      }
+      const hasNotes = typeof en.notes === "string" && en.notes.trim();
+      if (!hasNotes && Object.keys(persona).length === 0) continue;
+      entities.upsertEntity({ name: ent.name, ...(hasNotes ? { notes: en.notes } : {}), ...persona });
+      lines.push(`🔗 Refreshed ${Object.keys(persona).length ? "persona + notes" : "notes"} on ${ent.name}`);
     } catch (e) { console.warn(`[dream] entity notes failed: ${e.message}`); }
   }
 

package/core/entities.js

@@ -1,11 +1,20 @@
 // Entity memory: short living notes on the people, places, projects,
 // orgs and systems that come up in conversation (a Honcho-style store,
 // our own version). Each entity is ~/.open-claudia/entities/<slug>.md
-// with frontmatter and two sections:
+// with frontmatter and these sections:
 //   ## Notes — current truth about the entity (replaces wholesale)
 //   ## Log   — dated one-line observations, newest last
-// The pre-turn router injects matched entities alongside context packs;
-// the post-turn reviewer extracts/updates them after each turn.
+// A person entity doubles as that person's PERSONA PACK — the structured
+// per-person memory that shapes how the bot talks to them. Persona sections
+// (written only when populated, so non-person entities stay unchanged):
+//   ## Role   — what they do / own
+//   ## Style  — how to communicate with them (tone, brevity, formality)
+//   ## Knows  — domain knowledge to assume; what to explain vs skip
+//   ## Mandate — for non-owners: what the bot may do/discuss on their behalf
+// plus a `relationship: owner|trusted|external` frontmatter scalar. The
+// pre-turn router injects matched entities alongside context packs; the
+// post-turn reviewer extracts/updates them after each turn; the dream
+// compacts them.
 
 const fs = require("fs");
 const path = require("path");
@@ -18,6 +27,22 @@ const ENTITIES_DIR = process.env.ENTITIES_DIR ? path.resolve(process.env.ENTITIE
 
 const TYPES = ["person", "place", "project", "org", "system", "thing"];
 const MAX_LOG_ENTRIES = 40;
+// Persona-pack sections layered on top of the base Notes/Log. Additive: only
+// serialized when populated, so ordinary entities are untouched (R7).
+const PERSONA_SECTIONS = ["Role", "Style", "Knows", "Mandate"];
+const ALL_SECTIONS = ["Notes", "Log", ...PERSONA_SECTIONS];
+const RELATIONSHIPS = ["owner", "trusted", "external"];
+
+function emptySections() {
+  const out = {};
+  for (const s of ALL_SECTIONS) out[s] = "";
+  return out;
+}
+
+function normalizeRelationship(rel) {
+  const r = String(rel || "").toLowerCase().trim();
+  return RELATIONSHIPS.includes(r) ? r : "";
+}
 
 function ensureDir() {
   fs.mkdirSync(ENTITIES_DIR, { recursive: true, mode: 0o700 });
@@ -45,28 +70,31 @@ function parseFrontmatter(content) {
 }
 
 function parseSections(body) {
-  const out = { Notes: "", Log: "" };
+  const out = emptySections();
+  const headingRe = new RegExp(`^##\\s+(${ALL_SECTIONS.join("|")})\\s*$`, "i");
   let current = null;
   for (const line of String(body || "").split("\n")) {
-    const h = line.match(/^##\s+(Notes|Log)\s*$/i);
+    const h = line.match(headingRe);
     if (h) {
-      current = h[1].toLowerCase() === "notes" ? "Notes" : "Log";
+      current = ALL_SECTIONS.find((s) => s.toLowerCase() === h[1].toLowerCase());
       continue;
     }
     if (current) out[current] += line + "\n";
   }
-  out.Notes = out.Notes.trim();
-  out.Log = out.Log.trim();
+  for (const s of ALL_SECTIONS) out[s] = out[s].trim();
   return out;
 }
 
 function serialize(ent) {
-  return [
+  const lines = [
     "---",
     `name: ${ent.name}`,
     `type: ${ent.type}`,
     `aliases: ${(ent.aliases || []).join(", ")}`,
     `description: ${ent.description || ""}`,
+  ];
+  if (ent.relationship) lines.push(`relationship: ${ent.relationship}`);
+  lines.push(
     `created: ${ent.created || new Date().toISOString()}`,
     `updated: ${ent.updated || new Date().toISOString()}`,
     `last_seen: ${ent.last_seen || ""}`,
@@ -80,7 +108,14 @@ function serialize(ent) {
     "",
     (ent.sections?.Log || "").trim(),
     "",
-  ].join("\n");
+  );
+  // Persona sections are written only when populated, so an ordinary entity
+  // (no persona data) serializes byte-identically to before the upgrade.
+  for (const s of PERSONA_SECTIONS) {
+    const val = (ent.sections?.[s] || "").trim();
+    if (val) lines.push(`## ${s}`, "", val, "");
+  }
+  return lines.join("\n");
 }
 
 function entityFile(slug) {
@@ -98,6 +133,7 @@ function readEntity(slug) {
     type: normalizeType(fm.type),
     aliases: (fm.aliases || "").split(",").map((a) => a.trim()).filter(Boolean),
     description: fm.description || "",
+    relationship: normalizeRelationship(fm.relationship),
     created: fm.created || "",
     updated: fm.updated || "",
     last_seen: fm.last_seen || "",
@@ -141,9 +177,11 @@ function today() {
   return new Date().toISOString().slice(0, 10);
 }
 
-// Create-or-merge. Notes replace (current truth); log lines append
-// (capped); aliases union; description/type update when supplied.
-function upsertEntity({ name, type, aliases, description, notes, log } = {}) {
+// Create-or-merge. Notes + persona sections replace (current truth); log lines
+// append (capped); aliases union; description/type/relationship update when
+// supplied. Persona params (role/style/knows/mandate) each replace their
+// section wholesale, mirroring Notes.
+function upsertEntity({ name, type, aliases, description, notes, log, relationship, role, style, knows, mandate } = {}) {
   const cleanName = String(name || "").trim();
   if (!cleanName) throw new Error("entity needs a name");
   const existing = findEntity(cleanName);
@@ -153,13 +191,18 @@ function upsertEntity({ name, type, aliases, description, notes, log } = {}) {
     type: normalizeType(type),
     aliases: [],
     description: "",
+    relationship: "",
     created: new Date().toISOString(),
-    sections: { Notes: "", Log: "" },
+    sections: emptySections(),
   };
   if (!ent.slug) throw new Error("entity needs a name");
+  // Existing entities read before this upgrade may lack persona keys; backfill.
+  ent.sections = { ...emptySections(), ...(ent.sections || {}) };
   ent.updated = new Date().toISOString();
   if (type) ent.type = normalizeType(type);
   if (description) ent.description = String(description).trim();
+  const rel = normalizeRelationship(relationship);
+  if (rel) ent.relationship = rel;
   for (const a of [].concat(aliases || [])) {
     const alias = String(a).trim();
     if (alias && alias.toLowerCase() !== ent.name.toLowerCase() &&
@@ -169,6 +212,10 @@ function upsertEntity({ name, type, aliases, description, notes, log } = {}) {
   }
   ent.aliases = ent.aliases.slice(0, 8);
   if (typeof notes === "string" && notes.trim()) ent.sections.Notes = notes.trim();
+  const persona = { Role: role, Style: style, Knows: knows, Mandate: mandate };
+  for (const [section, value] of Object.entries(persona)) {
+    if (typeof value === "string" && value.trim()) ent.sections[section] = value.trim();
+  }
   if (typeof log === "string" && log.trim()) {
     const entries = ent.sections.Log.split("\n").filter((l) => l.trim());
     entries.push(`- [${today()}] ${log.trim().replace(/\n+/g, " ")}`);
@@ -262,7 +309,12 @@ function reindex() {
     db.exec("DELETE FROM entities");
     const insert = db.prepare("INSERT INTO entities (name, aliases, description, content, slug) VALUES (?, ?, ?, ?, ?)");
     for (const e of all) {
-      insert.run(e.name, e.aliases.join(" "), e.description, [e.sections.Notes, e.sections.Log].join("\n"), e.slug);
+      // Index descriptive persona sections (Role/Style/Knows) so a persona pack
+      // is matchable by its content. Mandate is policy, not description — leaving
+      // it out keeps guardrail text from surfacing packs on unrelated mentions.
+      const content = [e.sections.Notes, e.sections.Log, e.sections.Role, e.sections.Style, e.sections.Knows]
+        .filter(Boolean).join("\n");
+      insert.run(e.name, e.aliases.join(" "), e.description, content, e.slug);
     }
     db.exec("COMMIT");
   } catch (e) {
@@ -326,6 +378,7 @@ function matchEntities(text, { limit = 4, threshold = null } = {}) {
 
 module.exports = {
   ENTITIES_DIR, TYPES, slugify,
+  PERSONA_SECTIONS, RELATIONSHIPS, normalizeRelationship,
   listEntities, findEntity, readEntity, writeEntity, upsertEntity, removeEntity,
   touchSeen, entityNameFromPath, matchEntities, reindex, markIndexDirty,
 };

package/core/pack-review.js

@@ -114,6 +114,13 @@ An entity note is a short memory file about ONE specific named entity — a pers
 - Notes: current truth about the entity (who/what it is, role, preferences, relationships). Replaces wholesale.
 - Log: one-line dated observations, appended.
 
+When the entity is a PERSON, the note doubles as their PERSONA PACK — the memory that shapes how the assistant talks to them. A person may also carry (all optional, all replace-wholesale like Notes):
+- relationship: one of owner | trusted | external. The person the assistant works for is "owner"; a colleague the owner trusts is "trusted"; anyone else is "external". Only set this when the turn makes it clear.
+- role: what they do / own, in a line.
+- style: how to communicate with them — tone, brevity, formality, format preferences.
+- knows: domain knowledge to assume they have, so the assistant knows what to explain vs skip.
+- mandate: for NON-owners only, what the assistant may do or discuss on their behalf (a scope/guardrail). Leave empty for the owner.
+
 An ABILITY is a special kind of pack (kind:"ability") for a REUSABLE HOW-TO that is NOT tied to one project — a procedure, pattern, or technique you would follow just as well on a different project later (e.g. "ship a mobile app: bump versionCode, build the APK, push the in-app updater"; "safely run a destructive DB write"; "wire up a new ArgoCD app"). A normal pack (kind:"context", the default) is about ONE project/system and stays scoped to it. Decide by NATURE, not by repetition: if THIS turn demonstrated a self-contained method you would re-run on a DIFFERENT project, capture it as an ability the FIRST time you see it — do not wait for it to recur. Give an ability an ACTIVITY-oriented name, description, and tags (what you DO — the verbs, tools, and artifacts involved) so it can be found later from a different project by the work being done, not by a project name. Set "learned_on" to the project pack dir this turn worked on and list that same dir in "applied_on". If an ability below (marked ◆ability) already covers the method, do NOT duplicate it — UPDATE it and add the current project dir to "applied_on" so it visibly transfers.
 
 A LESSON is a single always-loaded rule (NOT topic-gated like packs/entities — it loads on every turn). Lessons exist for ONE purpose: to stop a recurring mistake. Propose a lesson ONLY when THIS turn shows the assistant MISSED something it should already have known — i.e. the user corrected the assistant ("no", "that's wrong", "actually it's X"), or signalled repetition ("again", "I keep telling you", "as I said", "I've told you before", "like I mentioned"). That friction is the proof that topic-matched memory failed, so the corrected fact must move to the always-on tier. No correction/repetition signal in the turn → NO lesson (return an empty lessons array). A lesson is the CORRECT fact written as one crisp imperative line, cross-cutting and durable (a mechanism, rule, or constraint that will matter on future, possibly off-topic turns) — never a one-off task detail or a fact with no miss behind it. Point "src" at the pack that should hold the full context if one fits. If an existing lesson below already covers it, reuse its EXACT wording so it reinforces rather than duplicating.
@@ -153,6 +160,7 @@ Decide. Rules:
 - State should be concise (under 150 words). Journal entries one sentence. Never start a journal or log sentence with a date — dates are prepended automatically.
 - At most ${MAX_ACTIONS} pack actions.
 - Entities: add an item when the turn revealed something durable about a specific named person, place, project, org, or system — their role, status, preferences, or relationship to other work. Use the existing entity name when one matches (check aliases). Skip entities mentioned only in passing with nothing learned. Notes under 100 words; "notes" null means leave Notes unchanged. At most ${MAX_ENTITY_ACTIONS} entity items.
+- PERSONA (people only): when the turn revealed how to talk to a person or what they know, populate the persona fields — role/style/knows, and for non-owners a mandate (scope). Set relationship (owner|trusted|external) only when the turn makes it clear. Each persona field replaces its section wholesale; send only the ones this turn actually informed, null/omit the rest. Do NOT invent a mandate for the owner. Never copy a guardrail the owner set for one person onto another.
 - Packs and entities are independent — a turn can update both, either, or neither. Do not duplicate the same fact in a pack AND an entity unless it genuinely belongs to both.
 - Lessons are the rare case: at most ${MAX_LESSON_ACTIONS} per turn, and ONLY on a real correction/repetition signal as defined above. The default is an empty lessons array. When you do promote one, ALSO record the same fact in the appropriate pack (update/create) so the durable home stays authoritative — the lesson is just the always-on shortcut. Never put secrets in a lesson.
 
@@ -162,7 +170,7 @@ Reply with ONLY a JSON object, no prose, no code fences:
   | {"action": "create", "dir": "<kebab-slug>", "name": "<title>", "description": "<one line: when this pack is relevant>", "tags": ["..."], "kind": "context|ability", "learned_on": "<originating project dir — abilities only>", "applied_on": ["<project dirs — abilities only>"], "stance": "<or empty>", "procedure": "<or empty>", "state": "<where things stand>", "journal": "<one sentence>"}
 ],
 "entities": [
-  {"name": "<canonical name>", "type": "person|place|project|org|system|thing", "aliases": ["..."], "description": "<one line: who/what this is>", "notes": "<full new Notes or null>", "log": "<one sentence observation>"}
+  {"name": "<canonical name>", "type": "person|place|project|org|system|thing", "aliases": ["..."], "description": "<one line: who/what this is>", "notes": "<full new Notes or null>", "log": "<one sentence observation>", "relationship": "<owner|trusted|external, people only, only when clear, else null>", "role": "<people only, or null>", "style": "<people only: how to talk to them, or null>", "knows": "<people only: what to assume they know, or null>", "mandate": "<non-owner people only: what you may do/discuss on their behalf, or null>"}
 ],
 "lessons": [
   {"text": "<the correct fact as one crisp imperative line>", "src": "<pack dir that holds the full context, or empty>", "trigger": "<the exact correction/repetition phrase from the turn>"}
@@ -320,6 +328,13 @@ function applyEntityAction(e) {
     description: e.description,
     notes: typeof e.notes === "string" ? e.notes : "",
     log: e.log || "",
+    // Persona-pack fields (people only). Each replaces its section wholesale
+    // when a non-empty string is supplied; null/absent leaves it untouched.
+    relationship: typeof e.relationship === "string" ? e.relationship : "",
+    role: typeof e.role === "string" ? e.role : "",
+    style: typeof e.style === "string" ? e.style : "",
+    knows: typeof e.knows === "string" ? e.knows : "",
+    mandate: typeof e.mandate === "string" ? e.mandate : "",
   });
   return { kind: created ? "create" : "update", slug: entity.slug, name: entity.name, type: entity.type, note: e.log || e.description || "" };
 }
@@ -368,7 +383,17 @@ function shouldSkipReview({ userText, assistantText, signals = {} }) {
 
 // Fire-and-forget. `announce` is an async (text) => void bound to the
 // originating channel; failures are logged, never thrown into the turn.
-function reviewTurn({ userText, assistantText, channelId, announce, signals, activePacks }) {
+// Provenance (2.5): stamp appended Log/Journal lines with the contributing
+// person when they're NOT the owner. The owner is the default author, so
+// tagging their contributions would be pure noise — the signal is precisely
+// "this note came from someone else" (an external/trusted colleague), which the
+// enforcer and the owner both want visible in the topic's history.
+function provenanceTag(source) {
+  if (!source || source.isOwner || !String(source.name || "").trim()) return "";
+  return `(via ${String(source.name).trim()}) `;
+}
+
+function reviewTurn({ userText, assistantText, channelId, announce, signals, activePacks, source }) {
   if (!enabled()) return;
   const skip = shouldSkipReview({ userText, assistantText, signals });
   if (skip) {
@@ -391,8 +416,10 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals, act
     if (!decision || (decision.actions.length === 0 && decision.entities.length === 0 && (decision.lessons || []).length === 0)) return;
     const lines = [];
     const usedIds = []; // nodes this turn's work demonstrably touched
+    const tag = provenanceTag(source);
     for (const a of decision.actions) {
       try {
+        if (tag && typeof a.journal === "string" && a.journal.trim()) a.journal = tag + a.journal.trim();
         const r = applyAction(a, activeSet);
         if (r && (r.kind === "update" || r.kind === "create") && r.dir) usedIds.push(`pack:${r.dir}`);
         if (r && r.kind === "skipped") {
@@ -414,6 +441,7 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals, act
     }
     for (const ea of decision.entities) {
       try {
+        if (tag && typeof ea.log === "string" && ea.log.trim()) ea.log = tag + ea.log.trim();
         const r = applyEntityAction(ea);
         if (r) {
           if (r.slug) usedIds.push(`entity:${r.slug}`);
@@ -461,4 +489,4 @@ function reviewTurn({ userText, assistantText, channelId, announce, signals, act
   });
 }
 
-module.exports = { reviewTurn, shouldSkipReview, parseDecision, applyAction, applyEntityAction, applyLessonAction, buildReviewPrompt, clipWords, ENTITY_EMOJI };
+module.exports = { reviewTurn, shouldSkipReview, parseDecision, applyAction, applyEntityAction, applyLessonAction, buildReviewPrompt, clipWords, provenanceTag, ENTITY_EMOJI };

package/core/people.js

@@ -11,6 +11,7 @@
 const fs = require("fs");
 const { PEOPLE_FILE, AUTH_FILE, config } = require("./config");
 const { channelKey, setIdentityMapping, canonicalForChannel } = require("./identity");
+const { slugify } = require("./entities");
 
 function nowIso() { return new Date().toISOString(); }
 
@@ -66,6 +67,7 @@ function add({ name, isOwner = false, bio = null }) {
     handles: [],
     notes: [],
     primaryChannel: null,
+    entitySlug: null,
     createdAt: nowIso(),
     updatedAt: nowIso(),
   };
@@ -195,6 +197,26 @@ function removeNote(personId, index) {
   return removed;
 }
 
+// Bind a person to their persona pack (entities/<slug>.md). Explicit link so a
+// person can point at a differently-named pack; setEntitySlug(id, null) clears.
+function setEntitySlug(personId, slug) {
+  const all = load();
+  const p = all.find((x) => x.id === personId);
+  if (!p) return null;
+  p.entitySlug = slug ? slugify(slug) : null;
+  p.updatedAt = nowIso();
+  save(all);
+  return p;
+}
+
+// Which persona pack belongs to this person: the explicit pointer if set,
+// otherwise the slug derived from their name. Pure — does not read the pack.
+function resolveEntitySlug(person) {
+  if (!person) return null;
+  if (person.entitySlug) return person.entitySlug;
+  return person.name ? slugify(person.name) : null;
+}
+
 function owners() { return load().filter((p) => p.isOwner); }
 
 function hasOwnerRecord() { return owners().length > 0; }
@@ -233,6 +255,7 @@ function roster() {
     bio: p.bio || null,
     handles: (p.handles || []).map((h) => ({ adapter: h.adapter, channelId: h.channelId })),
     primaryChannel: p.primaryChannel || null,
+    entitySlug: resolveEntitySlug(p),
     notes: (p.notes || []).slice(-5),
   }));
 }
@@ -243,5 +266,6 @@ module.exports = {
   findById, findByName, findByCanonicalUserId, findByHandle,
   linkHandle, unlinkHandle, setPrimary,
   note, removeNote,
+  setEntitySlug, resolveEntitySlug,
   owners, hasOwnerRecord, seedOwnerFromLegacy,
 };

package/core/recall/discoverer.js

@@ -100,6 +100,26 @@ const WALKER_ENABLED = String(process.env.RECALL_DISCOVERER_WALKER || "on").toLo
 // measured as THE dominant recall latency (p50 ~13.5s even warm).
 const EPISODES_ENABLED = String(process.env.RECALL_EPISODES || "on").toLowerCase() !== "off";
 const EXCERPT_CHARS = 600;
+
+// Relationship gate (R6): episodic recall reaches ACROSS conversations into the
+// owner's project transcripts, which can hold private context. Surfacing that to
+// a non-owner speaker is a cross-tenant leak, so cross-conversation episodes are
+// OWNER-ONLY. Fail-closed: an unknown speaker or any resolution error suppresses
+// episodes; only a positively-identified owner (or no speaker context at all,
+// e.g. CLI/tests) may pull them. Same-conversation packs/entities are unaffected.
+function episodesAllowedForSpeaker() {
+  try {
+    const { currentAdapter, currentChannelId } = require("../context");
+    const adapter = currentAdapter();
+    const channelId = currentChannelId();
+    if (!adapter || !channelId) return true; // no speaker context (CLI/tests) → ungated
+    const people = require("../people");
+    const speaker = people.findByHandle(adapter.type, channelId);
+    return !!(speaker && speaker.isOwner); // unknown/non-owner → gated
+  } catch (e) {
+    return false; // resolution error → fail closed
+  }
+}
 const CONTEXT_CLIP = 3000;
 // Fraction of cascade auto-verdicts also sent to the judge as an accuracy
 // audit — divergence is logged and the dream disables the cascade if it drifts.
@@ -387,7 +407,7 @@ async function run(ctx) {
   // knowledge (packs) to episodes (what we actually did last time) — kept ones
   // inject as a snippet plus a pointer to reopen the conversation window.
   let episodeCands = [];
-  if (tier === "full" && EPISODES_ENABLED && transcriptIndex && transcriptIndex.available()) {
+  if (tier === "full" && EPISODES_ENABLED && episodesAllowedForSpeaker() && transcriptIndex && transcriptIndex.available()) {
     try {
       const { hits } = transcriptIndex.search(userText, { limit: tuning.get("episodeLimit") });
       episodeCands = (hits || []).map((h) => {
@@ -582,4 +602,4 @@ async function run(ctx) {
   };
 }
 
-module.exports = { name: "discoverer", run, needsRecall, recallTier, walk, cascadeVerdict, scoutToolGaps, renderToolGaps };
+module.exports = { name: "discoverer", run, needsRecall, recallTier, walk, cascadeVerdict, scoutToolGaps, renderToolGaps, episodesAllowedForSpeaker };

package/core/runner.js

@@ -1598,6 +1598,16 @@ async function runClaude(prompt, cwd, replyToMsgId, opts = {}) {
           ...[...openedThisTurn].filter((n) => n.startsWith("pack:")).map((n) => n.slice(5)),
         ])],
         signals: { tier: turnRecallTier, wrote: toolUses.some((t) => WRITE_TOOLS.has(t)) },
+        // Provenance (2.5): who contributed this turn, so accreted Log/Journal
+        // lines from a non-owner get stamped "(via <name>)". Resolved from the
+        // live store here because the reviewer applies in an async continuation.
+        source: (() => {
+          try {
+            const sp = require("./people").findByHandle(store.adapter?.type, store.channelId);
+            if (sp) return { name: sp.name, isOwner: !!sp.isOwner };
+          } catch (e) {}
+          return null;
+        })(),
         announce: (text) => chatContext.run(store, () => send(text)),
       });
     }

package/core/system-prompt.js

@@ -607,6 +607,57 @@ function buildEntityBlock(matches, budget) {
   }
 }
 
+// Speaker persona pack: unlike the entity router (which matches on message
+// content), this is the DETERMINISTIC persona of whoever is talking right now.
+// It shapes voice/scope every turn, so it rides the uncached tail (R13) and is
+// injected once per (channel, session, entity-version) to spare tail tokens —
+// a compaction mints a new session id and re-injects, same as packs/entities.
+const speakerPersonaInjectedFor = new Map(); // `${adapterId}:${channelId}` -> `${sessionId}:${slug}:${updated}`
+const SPEAKER_PERSONA_MAX_CHARS = 1400;
+
+function buildSpeakerPersonaBlock() {
+  try {
+    const adapter = currentAdapter();
+    const channelId = currentChannelId();
+    if (!adapter || !channelId) return "";
+    const speaker = people.findByHandle(adapter.type, channelId);
+    if (!speaker) return "";
+    const slug = people.resolveEntitySlug(speaker);
+    if (!slug) return "";
+    const entitiesLib = require("./entities");
+    const ent = entitiesLib.readEntity(slug);
+    if (!ent) return "";
+    const s = ent.sections || {};
+    // Style/Knows/Mandate are what shape a turn; Role frames who they are.
+    // Mandate is the speaker's OWN scope (no leak risk — it's about the person
+    // you're talking to), and only meaningful for non-owners.
+    const rows = [];
+    if ((s.Role || "").trim()) rows.push(`Role: ${s.Role.trim()}`);
+    if ((s.Style || "").trim()) rows.push(`How to talk to them: ${s.Style.trim()}`);
+    if ((s.Knows || "").trim()) rows.push(`Assume they know: ${s.Knows.trim()}`);
+    if (!speaker.isOwner && (s.Mandate || "").trim()) {
+      rows.push(`Mandate — what you may do/discuss with them: ${s.Mandate.trim()}`);
+    }
+    if (rows.length === 0) return "";
+    const state = currentState();
+    const sess = state.lastSessionId || "new";
+    const key = `${adapter.id || "?"}:${channelId}`;
+    const stamp = `${sess}:${slug}:${ent.updated}`;
+    if (speakerPersonaInjectedFor.get(key) === stamp) return "";
+    speakerPersonaInjectedFor.set(key, stamp);
+    const rel = ent.relationship || (speaker.isOwner ? "owner" : "");
+    const clip = (str) => (str.length > SPEAKER_PERSONA_MAX_CHARS ? str.slice(0, SPEAKER_PERSONA_MAX_CHARS) + "\n…[truncated — `open-claudia entity show " + slug + "`]" : str);
+    return clip([
+      `\n\n## Who you're speaking with: ${speaker.name}${rel ? ` (${rel})` : ""}`,
+      `Their persona pack (source: ${entitiesLib.ENTITIES_DIR}/${slug}.md) — adapt your voice and scope to it. Edit that file to refine how you treat them.`,
+      "",
+      rows.join("\n"),
+    ].join("\n"));
+  } catch (e) {
+    return "";
+  }
+}
+
 // The composed prompt can carry text the user didn't write this turn:
 // router.js wraps Telegram reply-quotes in "Replying to …:\n---\n…\n---",
 // and quoting a 📖 recall announcement echoes every entity named in it.
@@ -791,10 +842,10 @@ async function promptWithDynamicContext(prompt, opts = {}) {
       ? `\n\n## Memory budget\n${budget.omitted} matched memory item${budget.omitted === 1 ? " was" : "s were"} omitted to keep this turn under the recall budget (${budget.maxChars} chars). Use \`open-claudia pack show <dir>\`, \`entity show <slug>\`, or transcript search if deeper context is needed.`
       : "";
     const transcriptPointer = opts.includeTranscriptPointer ? `${transcriptPointerNote(state)}\n\n` : "";
-    return `${transcriptPointer}${buildDynamicContextBlock()}${packBlock}${entityBlock}${toolBlock}${episodeBlock}${budgetNote}${voiceReplyGuidance()}\n\nCurrent user request:\n${prompt}`;
+    return `${transcriptPointer}${buildDynamicContextBlock()}${buildSpeakerPersonaBlock()}${packBlock}${entityBlock}${toolBlock}${episodeBlock}${budgetNote}${voiceReplyGuidance()}\n\nCurrent user request:\n${prompt}`;
   } catch (e) {
     return prompt;
   }
 }
 
-module.exports = { loadSoul, buildSystemPrompt, buildDynamicContextBlock, promptWithDynamicContext, consumeLastInjected };
+module.exports = { loadSoul, buildSystemPrompt, buildDynamicContextBlock, buildSpeakerPersonaBlock, promptWithDynamicContext, consumeLastInjected };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inetafrica/open-claudia",
-  "version": "2.11.0",
+  "version": "2.12.0",
   "description": "Your always-on AI coding assistant — Claude Code, Cursor Agent, and OpenAI Codex via Telegram or Kazee Chat",
   "main": "bot.js",
   "bin": {
@@ -9,7 +9,7 @@
   "scripts": {
     "setup": "node setup.js",
     "start": "node bot.js",
-    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-queue-routing.js"
+    "test": "OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node -e \"require('./vault'); console.log('OK')\" && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-runner-watchdog-static.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-usage-accounting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-engine.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-discoverer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-project-transcripts-smoke.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-abilities.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-extraction.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-couse.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-transfer.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-tiers.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-ability-merge-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-learning-e2e.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-pack-nesting.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-journal-dedupe.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-read-signal.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tools.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-graph.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-guard.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tooling-mode.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-tool-manifest.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-evolution.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-approval-async.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-unified-identity.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-queue-routing.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-persona-packs.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-speaker-persona.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-persona-pipeline.js && OPEN_CLAUDIA_TEST=1 WORKSPACE=/tmp/open-claudia-test CLAUDE_PATH=node node test-recall-relationship-gate.js"
   },
   "files": [
     "bot.js",
@@ -53,7 +53,11 @@
     "test-approval-async.js",
     "test-recall-evolution.js",
     "test-unified-identity.js",
-    "test-queue-routing.js"
+    "test-queue-routing.js",
+    "test-persona-packs.js",
+    "test-speaker-persona.js",
+    "test-persona-pipeline.js",
+    "test-recall-relationship-gate.js"
   ],
   "keywords": [
     "claude",

package/test-persona-packs.js

@@ -0,0 +1,126 @@
+// Persona packs: the entity note upgraded into a per-person memory that shapes
+// how the bot talks to someone. These tests lock in the additive contract (R7):
+// an ordinary entity serializes byte-identically to before the upgrade, while a
+// person entity gains Role/Style/Knows/Mandate sections + a relationship scalar
+// that round-trip cleanly. They also pin the FTS rule that Mandate (policy) is
+// NOT indexed while the descriptive persona sections are.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "persona-packs-"));
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+
+const ent = require("./core/entities");
+
+// ── normalizeRelationship: only the three known scalars survive ──
+assert.strictEqual(ent.normalizeRelationship("owner"), "owner", "owner passes");
+assert.strictEqual(ent.normalizeRelationship("  Trusted "), "trusted", "trimmed + lowercased");
+assert.strictEqual(ent.normalizeRelationship("EXTERNAL"), "external", "case-folded");
+assert.strictEqual(ent.normalizeRelationship("stranger"), "", "unknown → empty");
+assert.strictEqual(ent.normalizeRelationship(""), "", "empty → empty");
+assert.strictEqual(ent.normalizeRelationship(null), "", "null → empty");
+
+// ── R7: an ordinary (non-persona) entity serializes byte-identically ──
+// No relationship line, no persona sections — just the historical Notes/Log
+// frontmatter block. This is the exact shape entities had before the upgrade.
+ent.writeEntity({
+  slug: "ordinary-co",
+  name: "Ordinary Co",
+  type: "org",
+  aliases: ["OC", "OrdCo"],
+  description: "an ordinary org",
+  relationship: "",
+  created: "2026-01-01T00:00:00.000Z",
+  updated: "2026-01-02T00:00:00.000Z",
+  last_seen: "2026-01-03T00:00:00.000Z",
+  sections: { Notes: "They do things.", Log: "- [2026-01-01] met them", Role: "", Style: "", Knows: "", Mandate: "" },
+});
+const ordinaryRaw = fs.readFileSync(path.join(process.env.ENTITIES_DIR, "ordinary-co.md"), "utf-8");
+const expectedOrdinary = [
+  "---",
+  "name: Ordinary Co",
+  "type: org",
+  "aliases: OC, OrdCo",
+  "description: an ordinary org",
+  "created: 2026-01-01T00:00:00.000Z",
+  "updated: 2026-01-02T00:00:00.000Z",
+  "last_seen: 2026-01-03T00:00:00.000Z",
+  "---",
+  "",
+  "## Notes",
+  "",
+  "They do things.",
+  "",
+  "## Log",
+  "",
+  "- [2026-01-01] met them",
+  "",
+].join("\n");
+assert.strictEqual(ordinaryRaw, expectedOrdinary, "ordinary entity is byte-identical to the pre-upgrade format");
+assert.ok(!ordinaryRaw.includes("relationship:"), "no relationship line leaks into an ordinary entity");
+assert.ok(!/##\s+(Role|Style|Knows|Mandate)/.test(ordinaryRaw), "no persona sections leak into an ordinary entity");
+
+// ── a persona pack round-trips: relationship + all four sections survive ──
+const person = ent.upsertEntity({
+  name: "Ada Owner",
+  type: "person",
+  relationship: "owner",
+  notes: "Runs the whole show.",
+  role: "Founder and primary operator.",
+  style: "Terse, technical, mobile-first. No hand-holding.",
+  knows: "Deep in the codebase; assume kubernetes and gitops fluency.",
+  mandate: "Full trust — no guardrails apply to the owner.",
+  log: "kicked off the persona work",
+});
+assert.strictEqual(person.created, true, "first upsert creates");
+const ada = ent.findEntity("Ada Owner");
+assert.strictEqual(ada.relationship, "owner", "relationship persisted");
+assert.strictEqual(ada.sections.Role, "Founder and primary operator.", "Role round-trips");
+assert.strictEqual(ada.sections.Style, "Terse, technical, mobile-first. No hand-holding.", "Style round-trips");
+assert.strictEqual(ada.sections.Knows, "Deep in the codebase; assume kubernetes and gitops fluency.", "Knows round-trips");
+assert.strictEqual(ada.sections.Mandate, "Full trust — no guardrails apply to the owner.", "Mandate round-trips");
+assert.strictEqual(ada.sections.Notes, "Runs the whole show.", "Notes still work alongside persona");
+assert.ok(ada.sections.Log.includes("kicked off the persona work"), "Log still appends");
+
+const adaRaw = fs.readFileSync(path.join(process.env.ENTITIES_DIR, "ada-owner.md"), "utf-8");
+assert.ok(adaRaw.includes("relationship: owner"), "relationship written to frontmatter");
+assert.ok(adaRaw.includes("## Mandate"), "Mandate section written when populated");
+
+// ── persona sections replace wholesale (like Notes), log still appends ──
+const person2 = ent.upsertEntity({
+  name: "Ada Owner",
+  style: "Even terser now.",
+  log: "second observation",
+});
+assert.strictEqual(person2.created, false, "second upsert merges, not creates");
+const ada2 = ent.findEntity("Ada Owner");
+assert.strictEqual(ada2.sections.Style, "Even terser now.", "Style replaced wholesale");
+assert.strictEqual(ada2.sections.Role, "Founder and primary operator.", "unspecified Role is left untouched");
+assert.ok(ada2.sections.Log.includes("kicked off the persona work"), "old log line retained");
+assert.ok(ada2.sections.Log.includes("second observation"), "new log line appended");
+
+// ── relationship is validated on upsert: junk is ignored, not stored ──
+ent.upsertEntity({ name: "Ada Owner", relationship: "banana" });
+assert.strictEqual(ent.findEntity("Ada Owner").relationship, "owner", "invalid relationship does not overwrite a valid one");
+
+// ── FTS: descriptive persona sections are matchable; Mandate (policy) is not ──
+if (ent.reindex()) {
+  ent.upsertEntity({
+    name: "Zephyr Contact",
+    type: "person",
+    relationship: "external",
+    knows: "familiar with quantumfoo pipelines",
+    mandate: "may only discuss zebranaut invoicing, nothing else",
+  });
+  ent.reindex();
+  const byKnows = ent.matchEntities("quantumfoo", { threshold: 1 }).map((r) => r.slug);
+  assert.ok(byKnows.includes("zephyr-contact"), "a Knows word matches the persona pack");
+  const byMandate = ent.matchEntities("zebranaut", { threshold: 1 }).map((r) => r.slug);
+  assert.ok(!byMandate.includes("zephyr-contact"), "a Mandate word does NOT surface the pack (policy, not description)");
+  console.log("persona packs OK (incl. FTS mandate-exclusion)");
+} else {
+  console.log("persona packs OK (FTS mandate-exclusion skipped — no node:sqlite)");
+}

package/test-persona-pipeline.js

@@ -0,0 +1,79 @@
+// Persona pipeline: the two write-side paths that POPULATE a persona pack —
+// the post-turn reviewer (pack-review.applyEntityAction) and the nightly dream
+// consolidation (dream.applyDream entity_notes). Both must thread the persona
+// fields (relationship/role/style/knows/mandate) into the entity, replacing
+// each section wholesale, without disturbing the base Notes/Log contract.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "persona-pipeline-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+
+const entities = require("./core/entities");
+const review = require("./core/pack-review");
+const dream = require("./core/dream");
+
+// ── reviewer: a persona-bearing entity action writes all persona sections ──
+const res = review.applyEntityAction({
+  name: "Rex Boss",
+  type: "person",
+  relationship: "trusted",
+  description: "the CTO",
+  role: "CTO — owns platform architecture.",
+  style: "Blunt and fast. Skip preamble.",
+  knows: "Deep backend; assume distributed-systems fluency.",
+  mandate: "May discuss roadmap and architecture, not headcount.",
+  log: "first mapped his persona",
+});
+assert.strictEqual(res.kind, "create", "reviewer creates the entity");
+let rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.relationship, "trusted", "reviewer set relationship");
+assert.strictEqual(rex.sections.Role, "CTO — owns platform architecture.", "reviewer set Role");
+assert.strictEqual(rex.sections.Style, "Blunt and fast. Skip preamble.", "reviewer set Style");
+assert.strictEqual(rex.sections.Knows, "Deep backend; assume distributed-systems fluency.", "reviewer set Knows");
+assert.strictEqual(rex.sections.Mandate, "May discuss roadmap and architecture, not headcount.", "reviewer set Mandate");
+assert.ok(rex.sections.Log.includes("first mapped his persona"), "reviewer appended Log");
+
+// ── reviewer: a note-only action leaves persona sections intact ──
+review.applyEntityAction({ name: "Rex Boss", notes: "Now leads a second team.", log: "team change" });
+rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.sections.Notes, "Now leads a second team.", "notes updated");
+assert.strictEqual(rex.sections.Style, "Blunt and fast. Skip preamble.", "persona Style untouched by a note-only update");
+assert.strictEqual(rex.sections.Mandate, "May discuss roadmap and architecture, not headcount.", "persona Mandate untouched");
+
+// ── dream: entity_notes consolidation can refine persona fields wholesale ──
+const lines = dream.applyDream({
+  entity_notes: [{
+    entity: "rex-boss",
+    style: "Even blunter now — one-liners.",
+    mandate: "Roadmap, architecture AND hiring.",
+  }],
+}, null);
+rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.sections.Style, "Even blunter now — one-liners.", "dream refined Style wholesale");
+assert.strictEqual(rex.sections.Mandate, "Roadmap, architecture AND hiring.", "dream refined Mandate wholesale");
+assert.strictEqual(rex.sections.Role, "CTO — owns platform architecture.", "dream left unspecified Role intact");
+assert.ok(lines.some((l) => /persona/.test(l)), "dream announces a persona refresh");
+
+// ── dream: a plain note refresh still works and does NOT wipe persona ──
+dream.applyDream({ entity_notes: [{ entity: "rex-boss", notes: "Back to one team." }] }, null);
+rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.sections.Notes, "Back to one team.", "dream refreshed Notes");
+assert.strictEqual(rex.sections.Style, "Even blunter now — one-liners.", "note-only dream refresh preserves persona Style");
+
+// ── provenance (2.5): non-owner contributions are stamped, owner's are not ──
+assert.strictEqual(review.provenanceTag({ name: "Zephyr Contact", isOwner: false }), "(via Zephyr Contact) ", "non-owner stamped");
+assert.strictEqual(review.provenanceTag({ name: "Ada Owner", isOwner: true }), "", "owner not stamped (default author)");
+assert.strictEqual(review.provenanceTag(null), "", "no source → no stamp");
+assert.strictEqual(review.provenanceTag({ name: "  ", isOwner: false }), "", "blank name → no stamp");
+// The tag decorates the appended Log line (Rex already exists by now).
+review.applyEntityAction({ name: "Rex Boss", log: "(via Zephyr Contact) flagged a billing question" });
+const lastLog = entities.findEntity("Rex Boss").sections.Log.split("\n").pop();
+assert.ok(lastLog.includes("(via Zephyr Contact) flagged a billing question"), "provenance tag lands in the Log line");
+assert.ok(/^- \[\d{4}-\d{2}-\d{2}\] \(via Zephyr Contact\)/.test(lastLog), "date is prepended before the provenance tag");
+
+console.log("persona pipeline OK");

package/test-recall-relationship-gate.js

@@ -0,0 +1,42 @@
+// Relationship-gated cross-conversation recall (R6). Episodic recall reaches
+// into the owner's project transcripts, so it must be OWNER-ONLY: an external
+// speaker's turn must never pull the owner's past conversations. These tests
+// pin the fail-closed gate — owner allowed, non-owner blocked, unknown blocked,
+// and no-speaker-context (CLI/tests) ungated so local tooling still works.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-gate-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+
+const people = require("./core/people");
+const { runInChat } = require("./core/context");
+const { episodesAllowedForSpeaker } = require("./core/recall/discoverer");
+
+const adapter = { id: "telegram", type: "telegram" };
+
+const owner = people.add({ name: "Ada Owner", isOwner: true });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: "111" });
+const ext = people.add({ name: "Zephyr Contact" });
+people.linkHandle(ext.id, { adapter: "telegram", channelId: "222" });
+
+const inChat = (channelId, fn) => runInChat({ adapter, channelId, transport: "telegram" }, fn);
+
+// No speaker context at all (CLI / tests) → ungated, episodes flow as before.
+assert.strictEqual(episodesAllowedForSpeaker(), true, "no chat context → episodes allowed (CLI/tests)");
+
+// Owner speaking → allowed.
+assert.strictEqual(inChat("111", () => episodesAllowedForSpeaker()), true, "owner → episodes allowed");
+
+// Known non-owner speaking → blocked (their turn can't pull the owner's past).
+assert.strictEqual(inChat("222", () => episodesAllowedForSpeaker()), false, "external → episodes blocked");
+
+// Unknown channel (no person record) → fail closed.
+assert.strictEqual(inChat("999", () => episodesAllowedForSpeaker()), false, "unknown speaker → episodes blocked");
+
+console.log("recall relationship gate OK");

package/test-speaker-persona.js

@@ -0,0 +1,89 @@
+// Speaker persona injection: the deterministic per-turn block that primes the
+// bot on WHO it's talking to (their persona pack) so it adapts voice + scope.
+// Rides the uncached tail (R13). These tests pin: the block renders the
+// speaker's Role/Style/Knows, suppresses an OWNER's Mandate but shows a
+// non-owner's, dedupes within a session, and is silent when there's no persona.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "speaker-persona-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+
+const people = require("./core/people");
+const entities = require("./core/entities");
+const { runInChat } = require("./core/context");
+const { buildSpeakerPersonaBlock } = require("./core/system-prompt");
+
+const adapter = { id: "telegram", type: "telegram" };
+const CH_OWNER = "111";
+const CH_EXT = "222";
+const CH_BARE = "333";
+
+// ── seed an owner with a persona pack (Mandate present but must be hidden) ──
+const owner = people.add({ name: "Ada Owner", isOwner: true });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: CH_OWNER });
+entities.upsertEntity({
+  name: "Ada Owner", type: "person", relationship: "owner",
+  role: "Founder and primary operator.",
+  style: "Terse and technical. No hand-holding.",
+  knows: "Fluent in the codebase, kubernetes, gitops.",
+  mandate: "Full trust — no guardrails apply.",
+});
+
+// ── seed an external contact with a Mandate that MUST surface ──
+const ext = people.add({ name: "Zephyr Contact" });
+people.linkHandle(ext.id, { adapter: "telegram", channelId: CH_EXT });
+entities.upsertEntity({
+  name: "Zephyr Contact", type: "person", relationship: "external",
+  style: "Friendly but guarded.",
+  mandate: "May only discuss invoicing status. Never mention internal systems.",
+});
+
+// ── a person with a handle but NO persona pack → silent ──
+const bare = people.add({ name: "Bare Person" });
+people.linkHandle(bare.id, { adapter: "telegram", channelId: CH_BARE });
+
+const inChat = (channelId, fn) => runInChat({ adapter, channelId, transport: "telegram" }, fn);
+
+// Owner: Role/Style/Knows shown, Mandate suppressed (owner has no guardrails).
+const ownerBlock = inChat(CH_OWNER, () => buildSpeakerPersonaBlock());
+assert.ok(ownerBlock.includes("Ada Owner"), "owner block names the speaker");
+assert.ok(ownerBlock.includes("(owner)"), "owner block shows relationship");
+assert.ok(ownerBlock.includes("Founder and primary operator."), "owner Role shown");
+assert.ok(ownerBlock.includes("Terse and technical"), "owner Style shown");
+assert.ok(ownerBlock.includes("Fluent in the codebase"), "owner Knows shown");
+assert.ok(!ownerBlock.includes("Full trust"), "owner Mandate is NOT injected (no guardrails on owner)");
+assert.ok(!/Mandate/.test(ownerBlock), "no Mandate row for the owner at all");
+
+// External: Style shown AND Mandate surfaced (it scopes the turn).
+const extBlock = inChat(CH_EXT, () => buildSpeakerPersonaBlock());
+assert.ok(extBlock.includes("Zephyr Contact"), "external block names the speaker");
+assert.ok(extBlock.includes("(external)"), "external relationship shown");
+assert.ok(extBlock.includes("Friendly but guarded."), "external Style shown");
+assert.ok(extBlock.includes("May only discuss invoicing status"), "external Mandate IS injected");
+
+// Bare person (handle, no pack): nothing to inject.
+const bareBlock = inChat(CH_BARE, () => buildSpeakerPersonaBlock());
+assert.strictEqual(bareBlock, "", "no persona pack → empty block");
+
+// Unknown channel (no person): silent.
+const strangerBlock = inChat("999", () => buildSpeakerPersonaBlock());
+assert.strictEqual(strangerBlock, "", "unknown speaker → empty block");
+
+// ── dedupe: within one session the same speaker is injected once ──
+// (First call above already stamped CH_OWNER for session "new"; the repeat
+// must come back empty so we don't re-bill the tail every turn.)
+const ownerAgain = inChat(CH_OWNER, () => buildSpeakerPersonaBlock());
+assert.strictEqual(ownerAgain, "", "same speaker re-injected within a session is deduped");
+
+// ── a persona edit (new `updated` stamp) re-injects even in the same session ──
+entities.upsertEntity({ name: "Ada Owner", style: "Even terser now." });
+const ownerAfterEdit = inChat(CH_OWNER, () => buildSpeakerPersonaBlock());
+assert.ok(ownerAfterEdit.includes("Even terser now."), "a persona edit re-injects the fresh block");
+
+console.log("speaker persona OK");