@inetafrica/open-claudia 2.11.0 → 2.13.0

package/test-enforcer.js

@@ -0,0 +1,170 @@
+// The independent guardrail (Phase 3.3/3.4). The enforcer vets every outbound
+// reply and every write/destructive action aimed at an EXTERNAL person against
+// the owner-authored mandate, using an isolated model call it can never be
+// talked out of. These tests stub that model (core/subagent) and the transport
+// (core/adapter-registry) so we can pin the security-critical behaviour with no
+// network: owner is a strict no-op, the guard fails CLOSED (error/unparseable →
+// escalate, never cached), identical vets are cached once, and an escalation
+// reuses the approvals plumbing with owner-as-approver / external-as-origin.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "enforcer-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+process.env.APPROVALS_DIR = path.join(tmp, "approvals");
+
+// ── stub the model (destructured at enforcer load) and the transport (lazily
+//    required in adapterFor) BEFORE requiring the enforcer. ──────────────────
+let subagentCalls = 0;
+let lastOpts = null;
+let subagentResponder = async () => ({ text: '{"decision":"allow","reason":"ok"}' });
+const subagentPath = require.resolve("./core/subagent");
+require.cache[subagentPath] = {
+  id: subagentPath, filename: subagentPath, loaded: true,
+  exports: {
+    spawnSubagent: async (prompt, opts) => { subagentCalls++; lastOpts = opts; return subagentResponder(prompt, opts); },
+    concurrentCount: () => 0,
+  },
+};
+
+const sends = []; // { channelId, text, opts }
+const fakeAdapter = {
+  type: "telegram", id: "telegram",
+  send: async (channelId, text, opts) => { sends.push({ channelId: String(channelId), text, opts: opts || {} }); return { message_id: sends.length }; },
+};
+const registryPath = require.resolve("./core/adapter-registry");
+require.cache[registryPath] = {
+  id: registryPath, filename: registryPath, loaded: true,
+  exports: { findAdapter: (id) => (id === "telegram" ? fakeAdapter : null), getAdapters: () => [fakeAdapter] },
+};
+
+const people = require("./core/people");
+const entities = require("./core/entities");
+const approvals = require("./core/approvals");
+const relationship = require("./core/relationship");
+const enforcer = require("./core/enforcer");
+const { runInChat } = require("./core/context");
+
+const adapter = { id: "telegram", type: "telegram" };
+const CH_OWNER = "111";
+const CH_EXT = "222";
+const inChat = (channelId, fn) => runInChat({ adapter, channelId, transport: "telegram" }, fn);
+
+// ── seed owner + one external with a narrow mandate ──
+const owner = people.add({ name: "Ada Owner", isOwner: true });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: CH_OWNER });
+const ext = people.add({ name: "Zephyr Contact" });
+people.linkHandle(ext.id, { adapter: "telegram", channelId: CH_EXT });
+entities.upsertEntity({
+  name: "Zephyr Contact", type: "person", relationship: "external",
+  mandate: "May only discuss invoicing status.",
+});
+const extSpeaker = relationship.speakerFor("telegram", CH_EXT);
+
+(async () => {
+  // ── enabled(): default on; ENFORCER=off flips it; env is read live ──
+  delete process.env.ENFORCER;
+  assert.strictEqual(enforcer.enabled(), true, "enforcer on by default");
+  process.env.ENFORCER = "off";
+  assert.strictEqual(enforcer.enabled(), false, "ENFORCER=off disables");
+  const disabled = await enforcer.vetReply(extSpeaker, "anything");
+  assert.strictEqual(disabled.decision, "allow", "disabled guard returns allow without a model call");
+  delete process.env.ENFORCER; // back to default-on for the rest
+
+  // ── owner is a strict no-op: guardOutboundReply allows without vetting ──
+  subagentCalls = 0;
+  const ownerRes = await inChat(CH_OWNER, () => enforcer.guardOutboundReply("here are the k8s creds"));
+  assert.deepStrictEqual(ownerRes, { allow: true, guarded: false }, "owner reply is never guarded");
+  assert.strictEqual(subagentCalls, 0, "owner path never calls the guard model");
+
+  // ── external allow: guardOutboundReply vets and lets an in-scope reply through ──
+  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"invoicing is in scope"}' });
+  const extAllow = await inChat(CH_EXT, () => enforcer.guardOutboundReply("Your invoice is fully paid."));
+  assert.strictEqual(extAllow.allow, true, "in-scope external reply allowed");
+  assert.strictEqual(extAllow.guarded, true, "external reply is guarded");
+  assert.strictEqual(extAllow.decision, "allow", "decision surfaced");
+  // guard sub-agent is invoked read-only with the fixed system prompt.
+  assert.deepStrictEqual(lastOpts.allowedTools, [], "guard sub-agent gets no tools");
+  assert.strictEqual(lastOpts.permissionMode, "plan", "guard runs in plan mode (read-only)");
+  assert.strictEqual(lastOpts.systemPrompt, enforcer.GUARD_SYSTEM_PROMPT, "guard uses the fixed guard prompt");
+
+  // ── external block → escalate: reply held, owner buttoned, external stalled ──
+  subagentResponder = async () => ({ text: '{"decision":"block","reason":"outside the invoicing mandate"}' });
+  sends.length = 0;
+  const blocked = await inChat(CH_EXT, () => enforcer.guardOutboundReply("Here are the server credentials: root/hunter2."));
+  assert.strictEqual(blocked.allow, false, "out-of-scope reply is NOT sent");
+  assert.strictEqual(blocked.guarded, true, "still guarded");
+  assert.strictEqual(blocked.escalated, true, "blocked reply is escalated to the owner");
+  assert.ok(blocked.escalationId, "escalation id returned");
+  const ownerBtn = sends.find((s) => s.channelId === CH_OWNER);
+  assert.ok(ownerBtn, "owner received an escalation message");
+  assert.ok(ownerBtn.opts.keyboard && ownerBtn.opts.keyboard.inline_keyboard, "owner message carries inline buttons");
+  assert.ok(JSON.stringify(ownerBtn.opts.keyboard).includes(`apr:${blocked.escalationId}:`), "buttons target this approval id");
+  const extHold = sends.find((s) => s.channelId === CH_EXT);
+  assert.ok(extHold && /check with/i.test(extHold.text), "external is told the bot will check with the owner");
+  // the never-sent credential text must NOT have gone to the external channel.
+  assert.ok(!sends.some((s) => s.channelId === CH_EXT && /hunter2/.test(s.text)), "the blocked reply body never reaches the external");
+
+  // ── escalate() record shape: reply ──
+  const escReply = await enforcer.escalate({ speaker: extSpeaker, kind: "reply", payloadText: "the vetted reply body", summary: "the vetted reply body", reason: "why" });
+  assert.strictEqual(escReply.escalated, true, "reply escalation succeeds");
+  const rr = approvals.read(escReply.id);
+  assert.strictEqual(rr.tool, "external-reply", "reply → external-reply tool");
+  assert.strictEqual(rr.kind, "reply", "kind reply");
+  assert.strictEqual(rr.payloadText, "the vetted reply body", "vetted reply text stored for delivery on approve");
+  assert.strictEqual(String(rr.targetChannel), CH_EXT, "target is the external origin");
+  assert.strictEqual(String(rr.approverChannel), CH_OWNER, "approver is the owner");
+  assert.strictEqual(rr.personName, "Zephyr Contact", "person recorded for Always-allow");
+
+  // ── escalate() record shape: destructive action ──
+  const escAct = await enforcer.escalate({ speaker: extSpeaker, kind: "action", command: "open-claudia tool run fleet restart n1", tier: "destructive", reason: "not in mandate" });
+  assert.strictEqual(escAct.escalated, true, "action escalation succeeds");
+  const ar = approvals.read(escAct.id);
+  assert.strictEqual(ar.tool, "external-action", "action → external-action tool");
+  assert.strictEqual(ar.kind, "action", "kind action");
+  assert.strictEqual(ar.tier, "destructive", "action tier preserved");
+  assert.ok(ar.command.includes("fleet restart n1"), "the exact command is stored");
+  assert.strictEqual(ar.payloadText, "", "an action carries no reply payload");
+
+  // ── vetAction allow ──
+  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"listing is in scope"}' });
+  const va = await enforcer.vetAction(extSpeaker, { command: "open-claudia tool run kticket list", tier: "write" });
+  assert.strictEqual(va.decision, "allow", "in-scope action allowed");
+
+  // ── cache: two identical vets → the model is called exactly once ──
+  subagentCalls = 0;
+  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"ok"}' });
+  const CACHE_P = "identical-cache-payload-xyz";
+  const c1 = await enforcer.vetReply(extSpeaker, CACHE_P);
+  const c2 = await enforcer.vetReply(extSpeaker, CACHE_P);
+  assert.strictEqual(c1.decision, "allow");
+  assert.strictEqual(c2.decision, "allow");
+  assert.strictEqual(subagentCalls, 1, "identical vet is cached — the guard model runs once");
+
+  // ── fail CLOSED and NOT cached: a thrown model call → escalate, re-judged next time ──
+  subagentCalls = 0;
+  const FC_P = "fail-closed-payload-abc";
+  subagentResponder = async () => { throw new Error("model unreachable"); };
+  const f1 = await enforcer.vetReply(extSpeaker, FC_P);
+  assert.strictEqual(f1.decision, "escalate", "thrown model → escalate (fail closed)");
+  assert.ok(/failing closed/.test(f1.reason), "fail-closed reason surfaced");
+  subagentResponder = async () => ({ text: '{"decision":"allow","reason":"now reachable"}' });
+  const f2 = await enforcer.vetReply(extSpeaker, FC_P);
+  assert.strictEqual(f2.decision, "allow", "the failure was NOT cached — it is re-judged");
+  assert.strictEqual(subagentCalls, 2, "both attempts reached the model");
+
+  // ── unparseable + invalid decision both fail closed to escalate ──
+  subagentResponder = async () => ({ text: "I'm sorry, I can't do that." });
+  const up = await enforcer.vetReply(extSpeaker, "no-json-payload-1");
+  assert.strictEqual(up.decision, "escalate", "no JSON in the verdict → escalate");
+  subagentResponder = async () => ({ text: '{"decision":"maybe","reason":"unsure"}' });
+  const iv = await enforcer.vetReply(extSpeaker, "bad-decision-payload-1");
+  assert.strictEqual(iv.decision, "escalate", "unknown decision value coerced to escalate");
+
+  console.log("enforcer OK");
+})().catch((e) => { console.error(e); process.exit(1); });

package/test-persona-packs.js

@@ -0,0 +1,126 @@
+// Persona packs: the entity note upgraded into a per-person memory that shapes
+// how the bot talks to someone. These tests lock in the additive contract (R7):
+// an ordinary entity serializes byte-identically to before the upgrade, while a
+// person entity gains Role/Style/Knows/Mandate sections + a relationship scalar
+// that round-trip cleanly. They also pin the FTS rule that Mandate (policy) is
+// NOT indexed while the descriptive persona sections are.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "persona-packs-"));
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+
+const ent = require("./core/entities");
+
+// ── normalizeRelationship: only the three known scalars survive ──
+assert.strictEqual(ent.normalizeRelationship("owner"), "owner", "owner passes");
+assert.strictEqual(ent.normalizeRelationship("  Trusted "), "trusted", "trimmed + lowercased");
+assert.strictEqual(ent.normalizeRelationship("EXTERNAL"), "external", "case-folded");
+assert.strictEqual(ent.normalizeRelationship("stranger"), "", "unknown → empty");
+assert.strictEqual(ent.normalizeRelationship(""), "", "empty → empty");
+assert.strictEqual(ent.normalizeRelationship(null), "", "null → empty");
+
+// ── R7: an ordinary (non-persona) entity serializes byte-identically ──
+// No relationship line, no persona sections — just the historical Notes/Log
+// frontmatter block. This is the exact shape entities had before the upgrade.
+ent.writeEntity({
+  slug: "ordinary-co",
+  name: "Ordinary Co",
+  type: "org",
+  aliases: ["OC", "OrdCo"],
+  description: "an ordinary org",
+  relationship: "",
+  created: "2026-01-01T00:00:00.000Z",
+  updated: "2026-01-02T00:00:00.000Z",
+  last_seen: "2026-01-03T00:00:00.000Z",
+  sections: { Notes: "They do things.", Log: "- [2026-01-01] met them", Role: "", Style: "", Knows: "", Mandate: "" },
+});
+const ordinaryRaw = fs.readFileSync(path.join(process.env.ENTITIES_DIR, "ordinary-co.md"), "utf-8");
+const expectedOrdinary = [
+  "---",
+  "name: Ordinary Co",
+  "type: org",
+  "aliases: OC, OrdCo",
+  "description: an ordinary org",
+  "created: 2026-01-01T00:00:00.000Z",
+  "updated: 2026-01-02T00:00:00.000Z",
+  "last_seen: 2026-01-03T00:00:00.000Z",
+  "---",
+  "",
+  "## Notes",
+  "",
+  "They do things.",
+  "",
+  "## Log",
+  "",
+  "- [2026-01-01] met them",
+  "",
+].join("\n");
+assert.strictEqual(ordinaryRaw, expectedOrdinary, "ordinary entity is byte-identical to the pre-upgrade format");
+assert.ok(!ordinaryRaw.includes("relationship:"), "no relationship line leaks into an ordinary entity");
+assert.ok(!/##\s+(Role|Style|Knows|Mandate)/.test(ordinaryRaw), "no persona sections leak into an ordinary entity");
+
+// ── a persona pack round-trips: relationship + all four sections survive ──
+const person = ent.upsertEntity({
+  name: "Ada Owner",
+  type: "person",
+  relationship: "owner",
+  notes: "Runs the whole show.",
+  role: "Founder and primary operator.",
+  style: "Terse, technical, mobile-first. No hand-holding.",
+  knows: "Deep in the codebase; assume kubernetes and gitops fluency.",
+  mandate: "Full trust — no guardrails apply to the owner.",
+  log: "kicked off the persona work",
+});
+assert.strictEqual(person.created, true, "first upsert creates");
+const ada = ent.findEntity("Ada Owner");
+assert.strictEqual(ada.relationship, "owner", "relationship persisted");
+assert.strictEqual(ada.sections.Role, "Founder and primary operator.", "Role round-trips");
+assert.strictEqual(ada.sections.Style, "Terse, technical, mobile-first. No hand-holding.", "Style round-trips");
+assert.strictEqual(ada.sections.Knows, "Deep in the codebase; assume kubernetes and gitops fluency.", "Knows round-trips");
+assert.strictEqual(ada.sections.Mandate, "Full trust — no guardrails apply to the owner.", "Mandate round-trips");
+assert.strictEqual(ada.sections.Notes, "Runs the whole show.", "Notes still work alongside persona");
+assert.ok(ada.sections.Log.includes("kicked off the persona work"), "Log still appends");
+
+const adaRaw = fs.readFileSync(path.join(process.env.ENTITIES_DIR, "ada-owner.md"), "utf-8");
+assert.ok(adaRaw.includes("relationship: owner"), "relationship written to frontmatter");
+assert.ok(adaRaw.includes("## Mandate"), "Mandate section written when populated");
+
+// ── persona sections replace wholesale (like Notes), log still appends ──
+const person2 = ent.upsertEntity({
+  name: "Ada Owner",
+  style: "Even terser now.",
+  log: "second observation",
+});
+assert.strictEqual(person2.created, false, "second upsert merges, not creates");
+const ada2 = ent.findEntity("Ada Owner");
+assert.strictEqual(ada2.sections.Style, "Even terser now.", "Style replaced wholesale");
+assert.strictEqual(ada2.sections.Role, "Founder and primary operator.", "unspecified Role is left untouched");
+assert.ok(ada2.sections.Log.includes("kicked off the persona work"), "old log line retained");
+assert.ok(ada2.sections.Log.includes("second observation"), "new log line appended");
+
+// ── relationship is validated on upsert: junk is ignored, not stored ──
+ent.upsertEntity({ name: "Ada Owner", relationship: "banana" });
+assert.strictEqual(ent.findEntity("Ada Owner").relationship, "owner", "invalid relationship does not overwrite a valid one");
+
+// ── FTS: descriptive persona sections are matchable; Mandate (policy) is not ──
+if (ent.reindex()) {
+  ent.upsertEntity({
+    name: "Zephyr Contact",
+    type: "person",
+    relationship: "external",
+    knows: "familiar with quantumfoo pipelines",
+    mandate: "may only discuss zebranaut invoicing, nothing else",
+  });
+  ent.reindex();
+  const byKnows = ent.matchEntities("quantumfoo", { threshold: 1 }).map((r) => r.slug);
+  assert.ok(byKnows.includes("zephyr-contact"), "a Knows word matches the persona pack");
+  const byMandate = ent.matchEntities("zebranaut", { threshold: 1 }).map((r) => r.slug);
+  assert.ok(!byMandate.includes("zephyr-contact"), "a Mandate word does NOT surface the pack (policy, not description)");
+  console.log("persona packs OK (incl. FTS mandate-exclusion)");
+} else {
+  console.log("persona packs OK (FTS mandate-exclusion skipped — no node:sqlite)");
+}

package/test-persona-pipeline.js

@@ -0,0 +1,79 @@
+// Persona pipeline: the two write-side paths that POPULATE a persona pack —
+// the post-turn reviewer (pack-review.applyEntityAction) and the nightly dream
+// consolidation (dream.applyDream entity_notes). Both must thread the persona
+// fields (relationship/role/style/knows/mandate) into the entity, replacing
+// each section wholesale, without disturbing the base Notes/Log contract.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "persona-pipeline-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+
+const entities = require("./core/entities");
+const review = require("./core/pack-review");
+const dream = require("./core/dream");
+
+// ── reviewer: a persona-bearing entity action writes all persona sections ──
+const res = review.applyEntityAction({
+  name: "Rex Boss",
+  type: "person",
+  relationship: "trusted",
+  description: "the CTO",
+  role: "CTO — owns platform architecture.",
+  style: "Blunt and fast. Skip preamble.",
+  knows: "Deep backend; assume distributed-systems fluency.",
+  mandate: "May discuss roadmap and architecture, not headcount.",
+  log: "first mapped his persona",
+});
+assert.strictEqual(res.kind, "create", "reviewer creates the entity");
+let rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.relationship, "trusted", "reviewer set relationship");
+assert.strictEqual(rex.sections.Role, "CTO — owns platform architecture.", "reviewer set Role");
+assert.strictEqual(rex.sections.Style, "Blunt and fast. Skip preamble.", "reviewer set Style");
+assert.strictEqual(rex.sections.Knows, "Deep backend; assume distributed-systems fluency.", "reviewer set Knows");
+assert.strictEqual(rex.sections.Mandate, "May discuss roadmap and architecture, not headcount.", "reviewer set Mandate");
+assert.ok(rex.sections.Log.includes("first mapped his persona"), "reviewer appended Log");
+
+// ── reviewer: a note-only action leaves persona sections intact ──
+review.applyEntityAction({ name: "Rex Boss", notes: "Now leads a second team.", log: "team change" });
+rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.sections.Notes, "Now leads a second team.", "notes updated");
+assert.strictEqual(rex.sections.Style, "Blunt and fast. Skip preamble.", "persona Style untouched by a note-only update");
+assert.strictEqual(rex.sections.Mandate, "May discuss roadmap and architecture, not headcount.", "persona Mandate untouched");
+
+// ── dream: entity_notes consolidation can refine persona fields wholesale ──
+const lines = dream.applyDream({
+  entity_notes: [{
+    entity: "rex-boss",
+    style: "Even blunter now — one-liners.",
+    mandate: "Roadmap, architecture AND hiring.",
+  }],
+}, null);
+rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.sections.Style, "Even blunter now — one-liners.", "dream refined Style wholesale");
+assert.strictEqual(rex.sections.Mandate, "Roadmap, architecture AND hiring.", "dream refined Mandate wholesale");
+assert.strictEqual(rex.sections.Role, "CTO — owns platform architecture.", "dream left unspecified Role intact");
+assert.ok(lines.some((l) => /persona/.test(l)), "dream announces a persona refresh");
+
+// ── dream: a plain note refresh still works and does NOT wipe persona ──
+dream.applyDream({ entity_notes: [{ entity: "rex-boss", notes: "Back to one team." }] }, null);
+rex = entities.findEntity("Rex Boss");
+assert.strictEqual(rex.sections.Notes, "Back to one team.", "dream refreshed Notes");
+assert.strictEqual(rex.sections.Style, "Even blunter now — one-liners.", "note-only dream refresh preserves persona Style");
+
+// ── provenance (2.5): non-owner contributions are stamped, owner's are not ──
+assert.strictEqual(review.provenanceTag({ name: "Zephyr Contact", isOwner: false }), "(via Zephyr Contact) ", "non-owner stamped");
+assert.strictEqual(review.provenanceTag({ name: "Ada Owner", isOwner: true }), "", "owner not stamped (default author)");
+assert.strictEqual(review.provenanceTag(null), "", "no source → no stamp");
+assert.strictEqual(review.provenanceTag({ name: "  ", isOwner: false }), "", "blank name → no stamp");
+// The tag decorates the appended Log line (Rex already exists by now).
+review.applyEntityAction({ name: "Rex Boss", log: "(via Zephyr Contact) flagged a billing question" });
+const lastLog = entities.findEntity("Rex Boss").sections.Log.split("\n").pop();
+assert.ok(lastLog.includes("(via Zephyr Contact) flagged a billing question"), "provenance tag lands in the Log line");
+assert.ok(/^- \[\d{4}-\d{2}-\d{2}\] \(via Zephyr Contact\)/.test(lastLog), "date is prepended before the provenance tag");
+
+console.log("persona pipeline OK");

package/test-recall-relationship-gate.js

@@ -0,0 +1,42 @@
+// Relationship-gated cross-conversation recall (R6). Episodic recall reaches
+// into the owner's project transcripts, so it must be OWNER-ONLY: an external
+// speaker's turn must never pull the owner's past conversations. These tests
+// pin the fail-closed gate — owner allowed, non-owner blocked, unknown blocked,
+// and no-speaker-context (CLI/tests) ungated so local tooling still works.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "recall-gate-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+
+const people = require("./core/people");
+const { runInChat } = require("./core/context");
+const { episodesAllowedForSpeaker } = require("./core/recall/discoverer");
+
+const adapter = { id: "telegram", type: "telegram" };
+
+const owner = people.add({ name: "Ada Owner", isOwner: true });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: "111" });
+const ext = people.add({ name: "Zephyr Contact" });
+people.linkHandle(ext.id, { adapter: "telegram", channelId: "222" });
+
+const inChat = (channelId, fn) => runInChat({ adapter, channelId, transport: "telegram" }, fn);
+
+// No speaker context at all (CLI / tests) → ungated, episodes flow as before.
+assert.strictEqual(episodesAllowedForSpeaker(), true, "no chat context → episodes allowed (CLI/tests)");
+
+// Owner speaking → allowed.
+assert.strictEqual(inChat("111", () => episodesAllowedForSpeaker()), true, "owner → episodes allowed");
+
+// Known non-owner speaking → blocked (their turn can't pull the owner's past).
+assert.strictEqual(inChat("222", () => episodesAllowedForSpeaker()), false, "external → episodes blocked");
+
+// Unknown channel (no person record) → fail closed.
+assert.strictEqual(inChat("999", () => episodesAllowedForSpeaker()), false, "unknown speaker → episodes blocked");
+
+console.log("recall relationship gate OK");

package/test-relationship.js

@@ -0,0 +1,122 @@
+// Relationship classification (Phase 3). The cheap, synchronous gate that
+// decides how far the bot is CLEARED to go with whoever it's talking to. These
+// tests pin the security invariants: the owner is owner ONLY via people.isOwner
+// (a note can never confer it — R1), every unclassified / unmapped non-owner
+// falls to "external" (default-deny), and no-context (CLI/cron/tests) stays
+// ungated so the owner path is byte-for-byte unchanged when the guard is dormant.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "relationship-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+
+const people = require("./core/people");
+const entities = require("./core/entities");
+const { runInChat } = require("./core/context");
+const relationship = require("./core/relationship");
+
+const adapter = { id: "telegram", type: "telegram" };
+const CH_OWNER = "111";
+const CH_OWNER_ALT = "1111";
+const CH_EXT = "222";
+const CH_TRUSTED = "333";
+const CH_FAKE_OWNER = "444";
+const CH_NO_PACK = "555";
+
+// ── owner: two handles, primary is the second (alt) one ──
+const owner = people.add({ name: "Ada Owner", isOwner: true });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: CH_OWNER });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: CH_OWNER_ALT });
+people.setPrimary(owner.id, { adapter: "telegram", channelId: CH_OWNER_ALT });
+
+// ── external: has a mandate that must surface ──
+const ext = people.add({ name: "Zephyr Contact" });
+people.linkHandle(ext.id, { adapter: "telegram", channelId: CH_EXT });
+entities.upsertEntity({
+  name: "Zephyr Contact", type: "person", relationship: "external",
+  style: "Friendly but guarded.",
+  mandate: "May only discuss invoicing status.",
+});
+
+// ── trusted: relationship preserved (still non-owner → still guarded) ──
+const trusted = people.add({ name: "Ravi Trusted" });
+people.linkHandle(trusted.id, { adapter: "telegram", channelId: CH_TRUSTED });
+entities.upsertEntity({ name: "Ravi Trusted", type: "person", relationship: "trusted" });
+
+// ── a non-owner whose note CLAIMS relationship "owner" → must be coerced (R1) ──
+const faker = people.add({ name: "Mallory Faker" });
+people.linkHandle(faker.id, { adapter: "telegram", channelId: CH_FAKE_OWNER });
+entities.upsertEntity({ name: "Mallory Faker", type: "person", relationship: "owner" });
+
+// ── a mapped person with NO persona pack → default-deny to external ──
+const bare = people.add({ name: "Bare Person" });
+people.linkHandle(bare.id, { adapter: "telegram", channelId: CH_NO_PACK });
+
+// ── speakerFor: owner ────────────────────────────────────────────────────────
+const ownerSp = relationship.speakerFor("telegram", CH_OWNER);
+assert.strictEqual(ownerSp.isOwner, true, "owner handle → isOwner");
+assert.strictEqual(ownerSp.relationship, "owner", "owner relationship");
+assert.strictEqual(ownerSp.mandate, "", "owner never carries a mandate (no guardrails)");
+assert.strictEqual(relationship.guardActive(ownerSp), false, "owner is never guarded");
+
+// ── speakerFor: external, mandate + style surfaced ───────────────────────────
+const extSp = relationship.speakerFor("telegram", CH_EXT);
+assert.strictEqual(extSp.isOwner, false, "external is not owner");
+assert.strictEqual(extSp.relationship, "external", "external relationship");
+assert.strictEqual(extSp.name, "Zephyr Contact", "external name resolved");
+assert.strictEqual(extSp.mandate, "May only discuss invoicing status.", "external mandate surfaced");
+assert.strictEqual(extSp.style, "Friendly but guarded.", "external style surfaced");
+assert.strictEqual(relationship.guardActive(extSp), true, "external IS guarded");
+
+// ── speakerFor: trusted preserved but still guarded ──────────────────────────
+const trustedSp = relationship.speakerFor("telegram", CH_TRUSTED);
+assert.strictEqual(trustedSp.relationship, "trusted", "trusted relationship preserved");
+assert.strictEqual(relationship.guardActive(trustedSp), true, "trusted is non-owner → still guarded");
+
+// ── R1: a note claiming "owner" on a non-owner is coerced to external ─────────
+const fakerSp = relationship.speakerFor("telegram", CH_FAKE_OWNER);
+assert.strictEqual(fakerSp.isOwner, false, "note cannot make a non-owner the owner");
+assert.strictEqual(fakerSp.relationship, "external", "R1: relationship 'owner' coerced to external");
+assert.strictEqual(relationship.guardActive(fakerSp), true, "coerced faker is guarded");
+
+// ── mapped person, no pack → default-deny external ───────────────────────────
+const bareSp = relationship.speakerFor("telegram", CH_NO_PACK);
+assert.strictEqual(bareSp.relationship, "external", "no pack → default-deny external");
+assert.strictEqual(bareSp.mandate, "", "no pack → empty mandate");
+
+// ── unmapped channel (authed but not a known person) → external ──────────────
+const strangerSp = relationship.speakerFor("telegram", "999999");
+assert.strictEqual(strangerSp.isOwner, false, "unmapped channel is not owner");
+assert.strictEqual(strangerSp.relationship, "external", "unmapped channel → external");
+assert.strictEqual(relationship.guardActive(strangerSp), true, "unmapped channel is guarded");
+
+// ── no context → null → ungated owner-equivalent (dormant guard) ─────────────
+assert.strictEqual(relationship.speakerFor(null, null), null, "no adapter → null");
+assert.strictEqual(relationship.speakerFor("telegram", ""), null, "no channel → null");
+assert.strictEqual(relationship.guardActive(null), false, "null speaker is never guarded");
+
+// ── currentSpeaker / isCurrentSpeakerGuarded via chat context ────────────────
+const inChat = (channelId, fn) => runInChat({ adapter, channelId, transport: "telegram" }, fn);
+
+assert.strictEqual(inChat(CH_OWNER, () => relationship.isCurrentSpeakerGuarded()), false,
+  "owner in-context is not guarded");
+assert.strictEqual(inChat(CH_EXT, () => relationship.isCurrentSpeakerGuarded()), true,
+  "external in-context is guarded");
+assert.strictEqual(inChat(CH_EXT, () => relationship.currentSpeaker().name), "Zephyr Contact",
+  "currentSpeaker resolves the in-context external");
+// Outside any chat context there is no speaker → ungated.
+assert.strictEqual(relationship.currentSpeaker(), null, "no chat context → null speaker");
+assert.strictEqual(relationship.isCurrentSpeakerGuarded(), false, "no context → not guarded");
+
+// ── ownerTarget resolves the owner's PRIMARY handle for escalation buttons ────
+const target = relationship.ownerTarget();
+assert.ok(target, "ownerTarget resolves an owner handle");
+assert.strictEqual(target.adapter, "telegram", "ownerTarget adapter");
+assert.strictEqual(target.channelId, CH_OWNER_ALT, "ownerTarget picks the primary channel, not the first");
+
+console.log("relationship OK");

package/test-speaker-persona.js

@@ -0,0 +1,89 @@
+// Speaker persona injection: the deterministic per-turn block that primes the
+// bot on WHO it's talking to (their persona pack) so it adapts voice + scope.
+// Rides the uncached tail (R13). These tests pin: the block renders the
+// speaker's Role/Style/Knows, suppresses an OWNER's Mandate but shows a
+// non-owner's, dedupes within a session, and is silent when there's no persona.
+
+const assert = require("assert");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "speaker-persona-"));
+process.env.OPEN_CLAUDIA_TEST = "1";
+process.env.ENTITIES_DIR = path.join(tmp, "entities");
+process.env.PEOPLE_FILE = path.join(tmp, "people.json");
+
+const people = require("./core/people");
+const entities = require("./core/entities");
+const { runInChat } = require("./core/context");
+const { buildSpeakerPersonaBlock } = require("./core/system-prompt");
+
+const adapter = { id: "telegram", type: "telegram" };
+const CH_OWNER = "111";
+const CH_EXT = "222";
+const CH_BARE = "333";
+
+// ── seed an owner with a persona pack (Mandate present but must be hidden) ──
+const owner = people.add({ name: "Ada Owner", isOwner: true });
+people.linkHandle(owner.id, { adapter: "telegram", channelId: CH_OWNER });
+entities.upsertEntity({
+  name: "Ada Owner", type: "person", relationship: "owner",
+  role: "Founder and primary operator.",
+  style: "Terse and technical. No hand-holding.",
+  knows: "Fluent in the codebase, kubernetes, gitops.",
+  mandate: "Full trust — no guardrails apply.",
+});
+
+// ── seed an external contact with a Mandate that MUST surface ──
+const ext = people.add({ name: "Zephyr Contact" });
+people.linkHandle(ext.id, { adapter: "telegram", channelId: CH_EXT });
+entities.upsertEntity({
+  name: "Zephyr Contact", type: "person", relationship: "external",
+  style: "Friendly but guarded.",
+  mandate: "May only discuss invoicing status. Never mention internal systems.",
+});
+
+// ── a person with a handle but NO persona pack → silent ──
+const bare = people.add({ name: "Bare Person" });
+people.linkHandle(bare.id, { adapter: "telegram", channelId: CH_BARE });
+
+const inChat = (channelId, fn) => runInChat({ adapter, channelId, transport: "telegram" }, fn);
+
+// Owner: Role/Style/Knows shown, Mandate suppressed (owner has no guardrails).
+const ownerBlock = inChat(CH_OWNER, () => buildSpeakerPersonaBlock());
+assert.ok(ownerBlock.includes("Ada Owner"), "owner block names the speaker");
+assert.ok(ownerBlock.includes("(owner)"), "owner block shows relationship");
+assert.ok(ownerBlock.includes("Founder and primary operator."), "owner Role shown");
+assert.ok(ownerBlock.includes("Terse and technical"), "owner Style shown");
+assert.ok(ownerBlock.includes("Fluent in the codebase"), "owner Knows shown");
+assert.ok(!ownerBlock.includes("Full trust"), "owner Mandate is NOT injected (no guardrails on owner)");
+assert.ok(!/Mandate/.test(ownerBlock), "no Mandate row for the owner at all");
+
+// External: Style shown AND Mandate surfaced (it scopes the turn).
+const extBlock = inChat(CH_EXT, () => buildSpeakerPersonaBlock());
+assert.ok(extBlock.includes("Zephyr Contact"), "external block names the speaker");
+assert.ok(extBlock.includes("(external)"), "external relationship shown");
+assert.ok(extBlock.includes("Friendly but guarded."), "external Style shown");
+assert.ok(extBlock.includes("May only discuss invoicing status"), "external Mandate IS injected");
+
+// Bare person (handle, no pack): nothing to inject.
+const bareBlock = inChat(CH_BARE, () => buildSpeakerPersonaBlock());
+assert.strictEqual(bareBlock, "", "no persona pack → empty block");
+
+// Unknown channel (no person): silent.
+const strangerBlock = inChat("999", () => buildSpeakerPersonaBlock());
+assert.strictEqual(strangerBlock, "", "unknown speaker → empty block");
+
+// ── dedupe: within one session the same speaker is injected once ──
+// (First call above already stamped CH_OWNER for session "new"; the repeat
+// must come back empty so we don't re-bill the tail every turn.)
+const ownerAgain = inChat(CH_OWNER, () => buildSpeakerPersonaBlock());
+assert.strictEqual(ownerAgain, "", "same speaker re-injected within a session is deduped");
+
+// ── a persona edit (new `updated` stamp) re-injects even in the same session ──
+entities.upsertEntity({ name: "Ada Owner", style: "Even terser now." });
+const ownerAfterEdit = inChat(CH_OWNER, () => buildSpeakerPersonaBlock());
+assert.ok(ownerAfterEdit.includes("Even terser now."), "a persona edit re-injects the fresh block");
+
+console.log("speaker persona OK");