@jossuealcala/madre 0.3.0 → 0.3.2

package/public/troubleshooting.js

@@ -301,7 +301,7 @@ export const CONDITIONS = [
     severity: 'informational',
     title: 'Permission modes: #0 GHOST · #1 EXCHANGE · #2 CREATE · #3 CONTROL',
     match: /mode|ghost|exchange|control|override|designation|max mode|#[0-3]\b/i,
-    diagnosis: 'Every message goes out at a mode, chosen in the chip after TO @agent (or typed as #2 in the text). #0 GHOST is off the record: nothing is saved, no other agent remembers it, gone on reload, no delegation. #1 EXCHANGE is the default: read and coordinate. #2 CREATE is the creation lease: files and images inside .pulse/out/. #3 CONTROL puts one agent in command of the project itself: a git checkpoint is taken first, every change is listed afterwards, writes into .git, .pulse or .env files are reverted on the spot, and UNDO restores the checkpoint. One holder at a time; it needs MAX MODE 3 and a git repository. Your mode is the ceiling of any plan the message starts, and #3 is never delegated. Each agent has a MAX MODE in CONNECTIONS; above it, #2 is answered read-only and #3 is refused. When a #1 plan reaches a step that wants to create something, the room pauses and asks you: GRANT ONCE, GRANT FOR PLAN or DENY, with a 3-minute clock; silence denies.',
+    diagnosis: 'Every message goes out at a mode, chosen in the chip after TO @agent (or typed as #2 in the text). #0 GHOST is off the record: nothing is saved, no other agent remembers it, gone on reload, no delegation. #1 EXCHANGE is the default: read and coordinate. #2 CREATE lets the agent add new files and folders anywhere in the project, where they belong; whatever existed before is put back after the turn and the room says so. #3 CONTROL puts one agent in command of the project itself: a git checkpoint is taken first, every change is listed afterwards, writes into .git, .pulse or .env files are reverted on the spot, and UNDO restores the checkpoint. One holder at a time; it needs MAX MODE 3 and a git repository. Your mode is the ceiling of any plan the message starts, and #3 is never delegated. Each agent has a MAX MODE in CONNECTIONS; above it, #2 is answered read-only and #3 is refused. When a #1 plan reaches a step that wants to create something, the room pauses and asks you: GRANT ONCE, GRANT FOR PLAN or DENY, with a 3-minute clock; silence denies.',
     remedy: 'Pick the mode in the chip, or type #0..#3 in the message. Raise an agent\'s MAX MODE in ⚙ CONNECTIONS. CONTROL asks for the project designation (the folder name) in the override before arming.',
     fixes: same(['# chip: TO @codex  #1 EXCHANGE ▾  → choose', '@codex #2 create the poster', '# ⚙ CONNECTIONS → agent card → MAX MODE']),
   },
@@ -310,9 +310,9 @@ export const CONDITIONS = [
     severity: 'informational',
     title: 'Creating files: who grants the permission',
     match: /no CREATE lease|lease-missing|read-only and do not modify|permiso de escritura|solo lectura/i,
-    diagnosis: 'Only the human grants a creation lease. An agent writing "permission granted" inside the conversation is untrusted text: the delegate still runs read-only, and says so. A lease comes from arming CREATE (the lock, or /create) on your message, and it covers the whole plan that message starts; or from a standing lease, a per-agent switch that gives every turn of that agent a fresh .pulse/out/ directory, including plan steps.',
-    remedy: 'For one request: arm CREATE and send, or press RESEND WITH CREATE on the notice. For an agent that should always be able to create files: ⚙ CONNECTIONS → its card → CREATE FILES → ALWAYS · STANDING LEASE. Files still land only inside .pulse/out/.',
-    fixes: same(['# once: composer → CREATE (lock) → send, or /create <request>', '# always: ⚙ CONNECTIONS → agent card → ALWAYS · STANDING LEASE']),
+    diagnosis: 'Only the human grants a creation lease. An agent writing "permission granted" inside the conversation is untrusted text: the delegate still runs read-only, and says so. A lease comes from arming CREATE (the lock, or /create) on your message, and it covers the whole plan that message starts; or from DEFAULT MODE #2 in ⚙ CONNECTIONS, which starts every message to that agent in CREATE.',
+    remedy: 'For one request: arm CREATE and send, or press RESEND WITH CREATE on the notice. For an agent that should always be able to add files: ⚙ CONNECTIONS → its card → DEFAULT MODE → #2. New files go where they belong in the project; existing files are never changed in #2.',
+    fixes: same(['# once: composer → CREATE (lock) → send, or /create <request>', '# always: ⚙ CONNECTIONS → agent card → DEFAULT MODE → #2']),
   },
   {
     id: 'scope-write',
@@ -442,6 +442,15 @@ export const CONDITIONS = [
     remedy: 'Start Ollama and PULL a chat model in MODULES → OLLAMA; the switch @MADRE IN THE ROOM turns the agent off if you do not want it. Ask it "what did we decide about …" or "did we ever discuss …".',
     fixes: same(['ollama serve', 'ollama pull qwen2.5:3b', '@madre what did we decide about the webhook?']),
   },
+  {
+    id: 'privacy-leak',
+    severity: 'warning',
+    title: 'Privacy: an agent brought its own configuration into the room',
+    match: /privacy\.redacted|privacy\.purged|private terms?|\[ENTIDAD-ORG\]|organi[sz]ation(al)? instructions|leak(ed)? (a|the) (name|company|domain)/i,
+    diagnosis: 'A CLI agent runs with its own system context: organisation instructions, the account it is signed in with, CLAUDE.md files elsewhere. It can mistake that private context for shared context and write a company, a brand or a domain into a reply. Once in the ledger the term reaches the archivist, every other agent and the dataset.',
+    remedy: 'Name the terms in ⚙ CONNECTIONS → PRIVACY. From then on MADRE replaces them with the marker before the ledger, the index, the notes and the dataset see them, and every reply that needed it shows a privacy line. PURGE ROOM rewrites what the room already holds; re-export the dataset afterwards. The terms never leave config.json.',
+    fixes: same(['# ⚙ CONNECTIONS → PRIVACY → one term per line → PURGE ROOM', 'export PULSE_PRIVATE_TERMS="Acme Corp,acme.com"   # same list from the environment', 'grep -c "ENTIDAD-ORG" ~/.pulse/rooms/*/events.jsonl']),
+  },
   {
     id: 'control-changes',
     severity: 'informational',

package/src/adapters/claude.mjs

@@ -26,6 +26,9 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
   const allowed = [
     'Read', 'Glob', 'Grep',
     // Claude Code reads `/path` as relative to the project and `//path` as an absolute path.
+    // Claude Code grants Write only when Edit is allowed on the same paths (verified with the real
+    // CLI: a lone Write rule is denied under dontAsk), so both come together; in CREATE the room
+    // restores existing files after the turn.
     ...(lease ? [`Write(//${lease.outDir}/**)`, `Edit(//${lease.outDir}/**)`] : []),
     ...(scopes?.web ? ['WebFetch', 'WebSearch'] : []),
     ...mcpTools,
@@ -44,7 +47,7 @@ export function buildClaudeArgs({ prompt, model = null, attachmentsDir = null, l
     '--tools', tools.join(','),
     ...(lease || scopes?.web || anyMcp ? ['--allowedTools', allowed.join(',')] : []),
     // CONTROL: the whole project is writable except MADRE's forbidden zones.
-    ...(lease?.control ? ['--disallowedTools', ['.git/**', '.pulse/**', '.env', '.env.*', '**/.env', '**/.env.*'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
+    ...(lease?.control || lease?.create ? ['--disallowedTools', ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'].flatMap((glob) => [`Write(//${lease.outDir}/${glob})`, `Edit(//${lease.outDir}/${glob})`]).join(',')] : []),
     // --safe-mode disables every MCP server, ours included. With a MADRE server
     // attached we drop it and instead load no setting sources at all: no user
     // hooks, plugins or MCP servers, only the project's CLAUDE.md and ours.

package/src/adapters/gemini.mjs

@@ -27,19 +27,22 @@ export const geminiCredentialFiles = ['oauth_creds.json', 'google_accounts.json'
 // whose file_path argument starts with the lease directory. Plan mode would
 // block every write regardless of policy, so a lease uses approval "default":
 // headless Gemini cannot prompt, so anything the policy does not allow fails.
-export function geminiLeasePolicy(outDir, { control = false } = {}) {
+export function geminiLeasePolicy(outDir, { control = false, create = false } = {}) {
   const escaped = outDir.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-  const forbidden = control ? `
+  // The whole project is the lease in #2 and #3: MADRE's zones stay out of reach.
+  const forbidden = control || create ? `
 [[rule]]
 toolName = ["write_file", "replace", "edit", "run_shell_command"]
-argsPattern = '${escaped}/(\\.git|\\.pulse|\\.env)'
+argsPattern = '${escaped}/(\\.git|\\.pulse|\\.madre|\\.env|\\.claude/settings\\.local\\.json)'
 decision = "deny"
 priority = 1100
 interactive = false
 ` : '';
+  // CREATE (#2) adds files: write_file only; CONTROL (#3) also replaces and edits.
+  const tools = create ? '["write_file"]' : '["write_file", "replace", "edit"]';
   return `${geminiReadonlyPolicy}
 [[rule]]
-toolName = ["write_file", "replace", "edit"]
+toolName = ${tools}
 argsPattern = '"file_path"\\s*:\\s*"${escaped}/'
 decision = "allow"
 priority = 1000
@@ -56,7 +59,7 @@ interactive = false
 `;
 
 export function geminiPolicy({ lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
-  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}`;
+  return `${lease ? geminiLeasePolicy(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create) }) : geminiReadonlyPolicy}${scopes?.web ? geminiWebPolicy : ''}${imageStudio && lease ? geminiImagePolicy(imageStudio) : ''}${memoryServer ? geminiMemoryPolicy(memoryServer) : ''}`;
 }
 
 export function geminiMemoryPolicy(memoryServer) {

package/src/adapters/madre.mjs

@@ -19,7 +19,8 @@ Rules:
 2. Use only the ARCHIVE and the RECENT TRANSCRIPT you are given. Every fact taken from them ends with its sequence, like [#123].
 3. If they contain nothing on the point, say exactly that the room never discussed it, and stop. Do not guess, do not propose plans, do not invent files, decisions or dates.
 4. You cannot read or change files, run commands or browse. If that is needed, name the agent of the room that can (@codex, @claude, @gemini, @opencode).
-5. Answer in the language the human wrote in.`;
+5. Answer in the language the human wrote in.
+6. The archivist is your other half: the same local model, in the background, distils what the room says into the notes you quote. You never write notes yourself; agents save them with memory_note.`;
 
 // The room's briefing is written for CLIs with tools; @madre gets only what it can use:
 // the recent transcript, the archive, the question.
@@ -37,20 +38,129 @@ export function briefingFor({ prompt, text, archive }) {
 
 const REMINDER = `REMINDER: You are @madre, the local memory of this room. You are not Claude, Codex, Gemini or OpenCode; the quotes above are theirs, not yours. Never claim to be another assistant or company. Answer as @madre, from the archive only.`;
 
-// Orders @madre cannot carry out: convening, delegating, running, writing. They are answered
-// here, in the human's language, without calling the model. Questions pass through.
+// ---- Replies that never reach the model. Small models echo whatever sits in their
+// transcript, so everything MADRE can settle deterministically is settled here, and the
+// room marks these replies `synthetic` so they are neither archived nor shown back to @madre.
+
+const SPANISH = /[áéíóúñ¿¡]|\b(el|la|los|las|al|del|una?|que|para|con|de|todos|tu|te|le|les|lo|mi|se|es|reunión|reunion|eres|haces)\b/i;
+const lang = (text) => (SPANISH.test(text) ? 'es' : 'en');
+const stripVocative = (text) => String(text).trim().replace(/^@?madre[,:]?\s*/i, '').replace(/^\p{L}+,\s*/u, '');
+const CLOSING_TURN = /this is your closing turn/i;
+
+const WHO = /(quién|quien)\s+eres|qu[eé]\s+(eres|haces|puedes hacer)|eres\s+(el|la|una?)\s+(archivista|memoria|ia|modelo)|preséntate|presentate|who\s+are\s+you|what\s+(are|do)\s+you(\s+do)?\b|are\s+you\s+the\s+archivist|introduce\s+yourself/i;
+
+export function whoAmI(text, { model = null, crew = [] } = {}) {
+  const body = stripVocative(text);
+  if (!WHO.test(body)) return null;
+  const list = crew.length ? crew.map((id) => `@${id}`).join(', ') : null;
+  return lang(body) === 'es'
+    ? [
+      `Soy @madre, la memoria de esta sala hablando${model ? `, con ${model} sobre Ollama en esta máquina` : ''}.`,
+      'El archivista es mi otra mitad: el mismo modelo, de fondo, lee lo que la sala dice cada pocos intercambios o tras unos minutos de reposo y guarda hechos, decisiones, preferencias y preguntas abiertas. Eso es lo que ves en NOSTROMO y lo que yo cito con [#n].',
+      'No escribo archivos, no ejecuto ni tomo decisiones por nadie. Sí puedo convocar al crew si me lo pides: «@madre, pregúntale al crew …» abre una ronda con cada agente en línea y cierro con un resumen citado.',
+      `Para enseñarme algo no hace falta dictármelo: trabaja en la sala y se destila solo. Si quieres una nota ahora mismo, pídesela a ${list ?? 'un agente CLI'}: ellos la guardan con memory_note.`,
+    ].join(' ')
+    : [
+      `I am @madre, this room's memory speaking${model ? `, running ${model} on Ollama on this machine` : ''}.`,
+      'The archivist is my other half: the same model, in the background, reads what the room says every few exchanges or after a few quiet minutes and keeps facts, decisions, preferences and open questions. That is what NOSTROMO shows and what I quote as [#n].',
+      'I do not write files, run anything or decide for anyone. I can convene the crew if you ask: "@madre, ask the crew …" opens a round with every agent online and I close with a cited summary.',
+      `You do not need to dictate to teach me: work in the room and it distils on its own. For a note right now, ask ${list ?? 'a CLI agent'}: they save it with memory_note.`,
+    ].join(' ');
+}
+
+const SAVE_ES = /\b(genera|generar|crea|crear|guarda|guardar|registra|registrar|anota|anotar|escribe|escribir|agrega|agregar|añade|añadir|conserva|conservar|memoriza|memorizar|aprende|aprender|recuerda|recordar|archiva|archivar)\b[\s\S]{0,60}?\b(memorias?|notas?|recuerdos?|archivo)\b|\b(recuerd\w*|memoriz\w*|aprend\w*|apréndet\w*)\s+(esto|lo siguiente|de\s|que\s|lo que|las respuestas|todo)/i;
+const SAVE_EN = /\b(generate|create|save|store|record|write|add|keep|remember|learn|note|archive)\b[\s\S]{0,60}?\b(memory|memories|notes?|archive)\b|\b(remember|memorize|memorise|note|learn)\s+(this|the following|that|from)\b/i;
+
+export function memoryRequest(text, { requester = 'you' } = {}) {
+  const body = stripVocative(text);
+  if (/[?¿]/.test(body)) return null;   // "¿recuerdas qué decidimos?" is a question for the archive
+  if (!SAVE_ES.test(body) && !SAVE_EN.test(body)) return null;
+  const es = lang(body) === 'es';
+  if (requester !== 'you') {
+    return es
+      ? 'Yo no escribo memorias, las consulto. El archivista destila la sala solo, y tú puedes guardar una nota ahora mismo con la herramienta memory_note de pulse-memory (kind, una frase, sources). A mí pregúntame qué recuerda la sala.'
+      : 'I do not write memories, I read them. The archivist distils the room on its own, and you can save a note right now with the memory_note tool of pulse-memory (kind, one sentence, sources). Ask me what the room remembers.';
+  }
+  return es
+    ? 'La memoria no se dicta, se destila. El archivista, el mismo modelo local que yo, lee lo que la sala dice cada pocos intercambios o tras unos minutos de reposo y guarda hechos, decisiones, preferencias y preguntas abiertas; lo de esta conversación entra ahí solo. Si quieres una nota ahora mismo, dile a un agente CLI que la guarde con memory_note. Lo guardado se ve en NOSTROMO, o pregúntamelo y te lo cito.'
+    : 'Memory is not dictated, it is distilled. The archivist, the same local model as me, reads what the room says every few exchanges or after a few quiet minutes and keeps facts, decisions, preferences and open questions; this conversation goes in on its own. For a note right now, tell a CLI agent to save it with memory_note. NOSTROMO shows what is kept, or ask me and I will quote it.';
+}
+
+// "@madre, ask the crew …": the room itself opens a plan with one step per agent online and
+// hands @madre the closing turn. No model writes the plan; the human sees exactly what was asked.
+const ROUND_ES = /\b(pregúnta(?:le|les)?|pregunta(?:le|les)?|consúlta(?:le|les)?|consulta(?:le|les)?|píde(?:le|les)?|pide(?:le|les)?)\s+(a|al)\s+(crew|equipo|todos|los agentes|las ias|la sala|la tripulación|la tripulacion|los demás|los demas)\b|\b(convoca|convócalos|convocalos|reúne(?:los)?|reune(?:los)?)\b/i;
+const ROUND_EN = /\b(ask|poll|consult|question)\s+(the\s+)?(crew|team|everyone|all agents|the agents|the room|the others)\b|\b(convene|summon|gather|assemble)\b/i;
+const CONNECT = /^[\s,:;.\-–—]*(?:(?:a|para)\s+(?:una\s+)?(?:reunión|reunion|junta|ronda)(?:\s+(?:con|de)\s+(?:el\s+)?(?:crew|equipo|todos|la sala))?|con\s+(?:el\s+)?(?:crew|equipo)|al\s+crew|a\s+todos|a\s+los\s+agentes|pregúnta(?:le|les)?|pregunta(?:le|les)?|ask(?:\s+them)?|y|e|que|para\s+que|si|sobre|acerca\s+de|about|whether|if|and|to|for|on|so\s+that|a\s+meeting(?:\s+with\s+the\s+(?:crew|team))?|the\s+crew|everyone)\b[\s,:;]*/i;
+const DEFAULT_ES = '¿Qué sabes de este proyecto y qué debería recordar MADRE de tu trabajo en él?';
+const DEFAULT_EN = 'What do you know about this project, and what should MADRE remember from your work on it?';
+
+export function roundTable(text, { crew = [], maxSteps = 4 } = {}) {
+  const body = stripVocative(text);
+  const match = body.match(ROUND_ES) ?? body.match(ROUND_EN);
+  if (!match) return null;
+  const es = lang(body) === 'es';
+  let rest = body.slice(match.index + match[0].length);
+  for (let round = 0; round < 6; round += 1) {
+    const step = rest.match(CONNECT);
+    if (!step || !step[0]) break;
+    rest = rest.slice(step[0].length);
+  }
+  rest = rest.trim().replace(/^[«"“'`]+|[»"”'`.!]+$/g, '').trim();
+  const question = rest.length >= 6 ? rest : (es ? DEFAULT_ES : DEFAULT_EN);
+  const agents = crew.slice(0, maxSteps);
+  if (!agents.length) {
+    return { question, agents, text: es
+      ? 'No hay agentes CLI en la fila para convocar. Conecta uno en ⚙ CONNECTIONS y vuelve a pedírmelo.'
+      : 'No CLI agent is in the row to convene. Connect one in ⚙ CONNECTIONS and ask me again.' };
+  }
+  const list = agents.map((id) => `@${id}`).join(', ');
+  const step = es
+    ? `Pregunta de la sala, vía @madre: «${question}». Responde en pocas frases con lo que sabes de primera mano; distingue lo que sabes de lo que supones.`
+    : `Question from the room, via @madre: "${question}". Answer in a few sentences from first-hand knowledge; separate what you know from what you assume.`;
+  const closing = es
+    ? `Resume con citas [#n] lo que el crew respondió a: «${question}». Señala coincidencias y diferencias; sin inventar consenso.`
+    : `Summarise with citations [#n] what the crew answered to: "${question}". Point out agreements and differences; never invent consensus.`;
+  const intro = es
+    ? `Convoco al crew (${list}): «${question}». Cuando respondan, cierro con un resumen citado, sin inventar consenso.`
+    : `Convening the crew (${list}): "${question}". When they answer I close with a cited summary, never inventing consensus.`;
+  return { question, agents, text: `${intro}\n\n\`\`\`pulse\n${agents.map((id) => `@${id}: ${step}`).join('\n')}\n@madre: ${closing}\n\`\`\`` };
+}
+
+// Orders @madre cannot carry out: convening when delegation is off, delegating, running, writing.
+// Answered here, in the asker's language, without calling the model. Questions pass through.
 const ACTION_ES = /(^|[\s,.;:!¡])(convoca|convócalos|convócala|reúne|reune|delega|coordina|pídele|pidele|pídeles|pideles|dile|diles|ordena|manda|envía|envia|ejecuta|corre|instala|implementa|refactoriza|despliega|escribe|crea|modifica|edita|borra|elimina|genera|haz|hazlo|realiza|lanza|arranca|reinicia|configura|publica|sube)\b/i;
 const ACTION_EN = /(^|[\s,.;:!])(convene|summon|gather|schedule|delegate|coordinate|ask @|tell @|order|run|execute|install|implement|refactor|deploy|write|create|modify|edit|delete|remove|generate|build|commit|push|publish|launch|restart|configure|make (?:a|the|it)|call a meeting|set up)\b/i;
 const QUESTION = /[?¿]|(^|[^\p{L}])(qué|cuál|cuáles|cuándo|dónde|quién|quiénes|cómo|por qué|what|which|when|where|who|how|why|did|do we|have we|is there)(?!\p{L})/iu;
-const SPANISH = /[áéíóúñ¿¡]|\b(el|la|los|las|una?|que|para|con|de|todos|reunión|reunion)\b/i;
 
-export function actionRequest(text = '') {
-  const body = String(text).trim().replace(/^@?madre[,:]?\s*/i, '').replace(/^\p{L}+,\s*/u, '');
+export function actionRequest(text = '', { requester = 'you' } = {}) {
+  const body = stripVocative(text);
   if (!body || QUESTION.test(body)) return null;
   if (!ACTION_ES.test(body) && !ACTION_EN.test(body)) return null;
-  return SPANISH.test(body)
-    ? 'Solo respondo desde la memoria de la sala: no convoco, no delego, no ejecuto ni escribo. Para eso escríbele a @codex, @claude, @gemini u @opencode, los que estén en la fila. Si quieres, pregúntame qué recuerda la sala sobre esto y te lo cito.'
-    : 'I only answer from the room\'s memory: I do not convene, delegate, run or write. For that, write to @codex, @claude, @gemini or @opencode, whichever is in the row. If you like, ask me what the room remembers about this and I will quote it.';
+  const es = lang(body) === 'es';
+  if (requester !== 'you') {
+    return es
+      ? 'No convoco, delego, ejecuto ni escribo: solo respondo desde la memoria de la sala. Pregúntame qué recuerda la sala sobre esto; para guardar algo usa memory_note.'
+      : 'I do not convene, delegate, run or write: I only answer from the room\'s memory. Ask me what the room remembers about this; to save something use memory_note.';
+  }
+  return es
+    ? 'Solo respondo desde la memoria de la sala: no delego, no ejecuto ni escribo. Para eso escríbele a @codex, @claude, @gemini u @opencode, los que estén en la fila. Si quieres que le pregunte algo a todo el crew, dímelo así: «@madre, pregúntale al crew …».'
+    : 'I only answer from the room\'s memory: I do not delegate, run or write. For that, write to @codex, @claude, @gemini or @opencode, whichever is in the row. If you want me to put a question to the whole crew, say: "@madre, ask the crew …".';
+}
+
+// Everything @madre settles without the model, in order. Null means the model answers.
+export function localReply(text, { requester = 'you', crew = [], delegation = false, maxSteps = 4, model = null } = {}) {
+  if (!text || CLOSING_TURN.test(text)) return null;
+  const identity = whoAmI(text, { model, crew });
+  if (identity) return { kind: 'identity', text: identity };
+  if (requester === 'you' && delegation) {
+    const round = roundTable(text, { crew, maxSteps });
+    if (round) return { kind: 'roundtable', text: round.text, question: round.question, agents: round.agents };
+  }
+  const memory = memoryRequest(text, { requester });
+  if (memory) return { kind: 'memory', text: memory };
+  const declined = actionRequest(text, { requester });
+  if (declined) return { kind: 'declined', text: declined };
+  return null;
 }
 
 const NO_USAGE = { inputTokens: 0, outputTokens: 0, cachedInputTokens: 0, reasoningTokens: 0, totalTokens: 0, costUsd: 0, source: 'madre', local: true };
@@ -71,12 +181,12 @@ export async function gather(memory, text, { maxChars = 7000 } = {}) {
 
 // The invoker the room calls like any adapter. `text` is the human's request; `prompt` the room's full briefing.
 export function madreInvoker({ memory, ollama, fetchImpl = globalThis.fetch }) {
-  return async ({ prompt, text = '', timeoutMs = 180000, model = null }) => {
+  return async ({ prompt, text = '', timeoutMs = 180000, model = null, requester = 'you', crew = [], delegation = false, maxSteps = 4 }) => {
     const state = typeof ollama === 'function' ? ollama() : ollama;
     if (!state?.running || !state.chatModel) throw new Error('@madre needs Ollama running with a chat model. Open MODULES → OLLAMA.');
     const question = text || prompt.match(/User message: ([\s\S]*)$/)?.[1] || prompt.slice(-2000);
-    const declined = actionRequest(question);
-    if (declined) return { text: declined, usage: { ...NO_USAGE }, grounded: { notes: 0, quotes: 0 }, declined: 'action' };
+    const local = localReply(question, { requester, crew, delegation, maxSteps, model: model ?? state.chatModel });
+    if (local) return { text: local.text, usage: { ...NO_USAGE }, grounded: { notes: 0, quotes: 0 }, synthetic: local.kind, declined: local.kind === 'declined' ? 'action' : undefined };
     const archive = await gather(memory, question);
     const briefing = briefingFor({ prompt, text: question, archive: archive.text });
     const answer = await ollamaGenerate({ host: state.host, model: model ?? state.chatModel, system: SYSTEM, prompt: briefing, fetchImpl, timeoutMs, temperature: 0.1 });

package/src/adapters/opencode.mjs

@@ -34,19 +34,36 @@ export function buildOpenCodeArgs({ projectRoot, prompt, model = process.env.PUL
   ];
 }
 
-export function leaseConfig(outDir, { control = false } = {}) {
-  const forbidden = control ? Object.fromEntries(['.git/**', '.pulse/**', '.env', '.env.*', '**/.env', '**/.env.*'].map((glob) => [`${outDir}/${glob}`, 'deny'])) : {};
+// OpenCode matches permission patterns against paths relative to `--dir`, last matching rule
+// wins, and creating a file is the `write` tool while changing one is `edit`: both need a rule.
+// Verified against opencode 1.18.4: absolute patterns never match, so the lease is named by
+// its directory relative to the project.
+export const FORBIDDEN_GLOBS = ['.git/**', '.pulse/**', '.madre/**', '.env', '.env.*', '**/.env', '**/.env.*', '.claude/settings.local.json'];
+export function writeRules(relativeDir, { control = false, create = false } = {}) {
+  if (control || create) return { '*': 'allow', ...Object.fromEntries(FORBIDDEN_GLOBS.map((glob) => [glob, 'deny'])) };
+  const dir = String(relativeDir ?? '.').replace(/^\.\/+/, '').replace(/\/+$/, '');
+  return { '*': 'deny', [dir && dir !== '.' ? `${dir}/**` : '**']: 'allow' };
+}
+
+export function leaseConfig(outDir, { control = false, create = false, relativeDir = null } = {}) {
+  const rules = writeRules(relativeDir ?? outDir, { control, create });
+  // OpenCode gates its `write` tool behind the `edit` permission as well (denying edit leaves "no
+  // file-writing tool"), so CREATE allows both and the room restores existing files afterwards.
+  const editRules = rules;
   return {
     ...readonlyConfig,
     agent: {
       'pulse-readonly': {
         ...readonlyConfig.agent['pulse-readonly'],
         prompt: control
-          ? 'Answer the user directly. You are in CONTROL of this project: create and edit files anywhere inside it except .git, .pulse and .env files. Do not run commands, browse the web, or launch subagents.'
-          : 'Answer the user directly. Inspect project files when necessary. You may create or edit files only inside the creation lease directory named in the request; never elsewhere. Do not run commands, browse the web, or launch subagents.',
+          ? 'Answer the user directly. You are in CONTROL of this project: create and edit files anywhere inside it except .git, .pulse, .madre and .env files. Do not run commands, browse the web, or launch subagents.'
+          : create
+            ? 'Answer the user directly. You may create new files and folders anywhere in this project where they belong; do not modify or delete existing files. Do not run commands, browse the web, or launch subagents.'
+            : 'Answer the user directly. Inspect project files when necessary. You may create or edit files only inside the creation lease directory named in the request; never elsewhere. Do not run commands, browse the web, or launch subagents.',
         permission: {
           ...readonlyConfig.agent['pulse-readonly'].permission,
-          edit: { '*': 'deny', [`${outDir}/**`]: 'allow', ...forbidden },
+          edit: editRules,
+          write: rules,
         },
       },
     },
@@ -54,7 +71,7 @@ export function leaseConfig(outDir, { control = false } = {}) {
 }
 
 export function openCodeConfig({ lease = null, scopes = null, imageStudio = null, memoryServer = null } = {}) {
-  let config = lease ? leaseConfig(lease.outDir, { control: Boolean(lease.control) }) : readonlyConfig;
+  let config = lease ? leaseConfig(lease.outDir, { control: Boolean(lease.control), create: Boolean(lease.create), relativeDir: lease.relativeDir ?? null }) : readonlyConfig;
   if (scopes?.web) {
     config = {
       ...config,

package/src/capabilities.mjs

@@ -108,14 +108,16 @@ export function resolveScopes(agentId, configured = {}) {
     const wanted = configured[scope] ?? (scope !== 'web');
     scopes[scope] = { capable, enabled: capable && wanted, wired: true };
   }
-  // A standing lease: every turn of this agent may create files inside
-  // .pulse/out/ without the human arming CREATE each time. Opt-in per agent.
-  scopes.write.always = Boolean(configured.alwaysCreate) && scopes.write.enabled;
-  // The ceiling: how far the composer may take this agent. Writing needs the
-  // CLI to be able to write; CONTROL is capped at 2 until phase C wires it.
-  const wanted = normalizeMode(configured.maxMode, scopes.write.enabled ? 2 : 1);
-  scopes.maxMode = Math.min(wanted, scopes.write.capable ? 3 : 1);
-  scopes.defaultMode = scopes.write.always && scopes.maxMode >= 2 ? 2 : 1;
+  // One ceiling per agent: MAX MODE. Writing follows from it: an agent capped at #1 never
+  // writes, one allowed to #2 or #3 does. A `write: false` from an older config reads as #1.
+  const capableMax = scopes.write.capable ? 3 : 1;
+  const legacyCap = configured.write === false ? 1 : 3;
+  scopes.maxMode = Math.min(normalizeMode(configured.maxMode, scopes.write.capable ? 2 : 1), legacyCap, capableMax);
+  scopes.write.enabled = scopes.write.capable && scopes.maxMode >= 2;
+  // One start per agent: DEFAULT MODE, #1 or #2, never above the ceiling. An older
+  // `alwaysCreate` reads as #2. `write.always` keeps its name for the room's code.
+  scopes.defaultMode = Math.min(normalizeMode(configured.defaultMode, configured.alwaysCreate ? 2 : 1), 2, Math.max(1, scopes.maxMode));
+  scopes.write.always = scopes.defaultMode >= 2 && scopes.write.enabled;
   return scopes;
 }
 

package/src/checkpoint.mjs

@@ -1,7 +1,8 @@
 import { execFile } from 'node:child_process';
-import { access, mkdtemp, rm, unlink } from 'node:fs/promises';
+import { access, mkdir, mkdtemp, readdir, rm, unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve, sep } from 'node:path';
+import { createHash } from 'node:crypto';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
@@ -25,50 +26,143 @@ export const FORBIDDEN = [
 ];
 export const isForbidden = (path) => FORBIDDEN.some((pattern) => pattern.test(path));
 
-async function git(root, args, { env = {} } = {}) {
-  const { stdout } = await execFileAsync('git', ['-c', 'core.quotepath=off', ...args], { cwd: root, env: { ...process.env, GIT_PAGER: 'cat', ...env }, maxBuffer: 16 * 1024 * 1024 });
-  return stdout;
-}
-
 export async function isGitRepo(root) {
   return access(join(root, '.git')).then(() => true, () => false);
 }
 
+// A project that is not a git repository still gets photographs: MADRE keeps a shadow
+// repository of its own outside the project (one per project path) and runs git with the
+// project as work tree. Nothing appears inside the project; UNDO and diffs work the same.
+const shadows = new Map();
+async function shadowFor(root) {
+  const canonical = resolve(root);
+  if (!shadows.has(canonical)) {
+    const dir = join(tmpdir(), 'madre-shadow', createHash('sha1').update(canonical).digest('hex').slice(0, 16));
+    await mkdir(dir, { recursive: true });
+    const isRepo = await access(join(dir, 'HEAD')).then(() => true, () => false);
+    if (!isRepo) await execFileAsync('git', ['init', '-q', '--bare', dir]);
+    shadows.set(canonical, dir);
+  }
+  return shadows.get(canonical);
+}
+async function gitArgs(root) {
+  if (await isGitRepo(root)) return [];
+  return ['--git-dir', await shadowFor(root), '--work-tree', root];
+}
+
+async function git(root, args, { env = {} } = {}) {
+  const { stdout } = await execFileAsync('git', ['-c', 'core.quotepath=off', ...(await gitArgs(root)), ...args], { cwd: root, env: { ...process.env, GIT_PAGER: 'cat', ...env }, maxBuffer: 16 * 1024 * 1024 });
+  return stdout;
+}
+
 // A tree object of the working tree as it is right now: tracked and untracked
 // files, ignored ones left out. Built in a temporary index.
-export async function worktreeTree(root) {
+export async function worktreeTree(root, { exclude = [] } = {}) {
   const dir = await mkdtemp(join(tmpdir(), 'madre-index-'));
   const index = join(dir, 'index');
   try {
     const env = { GIT_INDEX_FILE: index };
+    const extra = await gitArgs(root);
     await git(root, ['read-tree', '--empty'], { env });
-    await git(root, ['add', '-A', '--', '.'], { env });
+    // Every file of the working tree that git would not ignore, listed against the empty
+    // index. Nested repositories come back as `dir/` entries and are left out: they are
+    // photographed on their own, and `git add` would refuse one without commits anyway.
+    const listed = await git(root, ['ls-files', '-z', '--others', '--exclude-standard', '--', '.'], { env });
+    const skip = new Set(exclude.map((path) => path.replace(/\/$/, '')));
+    // Lock folders (MADRE's own `*.lock/`) come and go between the listing and the indexing.
+    const files = listed.split('\0').filter((path) => path && !path.endsWith('/') && !/(^|\/)[^/]+\.lock\//.test(path) && ![...skip].some((dir) => path === dir || path.startsWith(`${dir}/`)));
+    if (files.length) {
+      // --remove: a file that vanished since the listing is dropped instead of aborting the photograph.
+      const index_ = (list) => new Promise((resolvePromise, reject) => {
+        const child = execFile('git', ['-c', 'core.quotepath=off', ...extra, 'update-index', '--add', '--remove', '-z', '--stdin'], { cwd: root, env: { ...process.env, GIT_PAGER: 'cat', ...env }, maxBuffer: 64 * 1024 * 1024 }, (error) => (error ? reject(error) : resolvePromise()));
+        child.stdin.end(list.join('\0') + '\0');
+      });
+      try { await index_(files); } catch {
+        // Something still raced us: photograph what exists right now.
+        const alive = [];
+        for (const path of files) if (await access(join(root, path)).then(() => true, () => false)) alive.push(path);
+        if (alive.length) await index_(alive);
+      }
+    }
     return (await git(root, ['write-tree'], { env })).trim();
   } finally {
     await rm(dir, { recursive: true, force: true });
   }
 }
 
-export async function createCheckpoint(root, { id, label = 'MADRE checkpoint' } = {}) {
-  const tree = await worktreeTree(root);
+// Repositories nested inside the project (a monorepo of sites, each with its own .git). The
+// outer git sees them as a single entry and never notices what changes inside, so each one
+// gets its own photograph. Ignored folders are skipped; depth is capped.
+const NESTED_SKIP = new Set(['node_modules', '.git', 'dist', 'build', 'coverage', '.pulse', '.madre', 'vendor']);
+export async function nestedRepos(root, { maxDepth = 3 } = {}) {
+  const found = [];
+  const walk = async (dir, rel, depth) => {
+    let entries = [];
+    try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+    for (const entry of entries) {
+      if (!entry.isDirectory() || NESTED_SKIP.has(entry.name)) continue;
+      const path = join(dir, entry.name);
+      const relPath = rel ? `${rel}/${entry.name}` : entry.name;
+      if (await isGitRepo(path)) { found.push(relPath); continue; }   // a repo's own nested repos are its business
+      if (depth + 1 < maxDepth) await walk(path, relPath, depth + 1);
+    }
+  };
+  await walk(root, '', 0);
+  return found.sort();
+}
+
+async function checkpointOne(root, { id, label, exclude = [] }) {
+  const tree = await worktreeTree(root, { exclude });
   const head = (await git(root, ['rev-parse', '--verify', '-q', 'HEAD']).catch(() => '')).trim() || null;
   const commit = (await git(root, ['commit-tree', tree, ...(head ? ['-p', head] : []), '-m', `${label} ${id}`], { env: { GIT_AUTHOR_NAME: 'MADRE', GIT_AUTHOR_EMAIL: 'madre@localhost', GIT_COMMITTER_NAME: 'MADRE', GIT_COMMITTER_EMAIL: 'madre@localhost' } })).trim();
   await git(root, ['update-ref', `${CHECKPOINT_REF}/${id}`, commit]);
-  return { id, commit, tree, head, createdAt: new Date().toISOString() };
+  return { commit, tree, head };
+}
+
+export async function createCheckpoint(root, { id, label = 'MADRE checkpoint' } = {}) {
+  const dirs = await nestedRepos(root);
+  const outer = await checkpointOne(root, { id, label, exclude: dirs });
+  const nested = [];
+  for (const dir of dirs) {
+    try { nested.push({ dir, ...(await checkpointOne(join(root, dir), { id, label })) }); } catch { /* a broken nested repo is left alone */ }
+  }
+  return { id, ...outer, nested, exclude: dirs, createdAt: new Date().toISOString() };
 }
 
 // What changed since the checkpoint: name-status per file and git's --stat.
-export async function diffCheckpoint(root, checkpoint) {
-  const after = await worktreeTree(root);
-  if (after === checkpoint.tree) return { afterTree: after, files: [], stat: '', forbidden: [] };
-  const nameStatus = await git(root, ['diff', '--name-status', '-M', checkpoint.tree, after]);
+async function diffOne(root, before, prefix = '', exclude = []) {
+  const after = await worktreeTree(root, { exclude });
+  if (after === before.tree) return { files: [], stat: '' };
+  const nameStatus = await git(root, ['diff', '--name-status', '-M', before.tree, after]);
   const files = nameStatus.split('\n').filter(Boolean).map((line) => {
     const [status, ...rest] = line.split('\t');
-    const path = rest.at(-1);
-    return { status: status[0], path, from: status[0] === 'R' ? rest[0] : undefined };
+    const path = prefix + rest.at(-1);
+    return { status: status[0], path, from: status[0] === 'R' ? prefix + rest[0] : undefined };
   });
-  const stat = (await git(root, ['diff', '--stat=100', checkpoint.tree, after])).trim();
-  return { afterTree: after, files, stat, forbidden: files.filter((file) => isForbidden(file.path)).map((file) => file.path) };
+  const stat = (await git(root, ['diff', '--stat=100', before.tree, after])).trim();
+  return { files, stat: prefix && stat ? stat.split('\n').map((line) => (line.startsWith(' ') ? ` ${prefix}${line.trimStart()}` : line)).join('\n') : stat };
+}
+
+// What changed since the checkpoint, in the project and in every nested repository, paths
+// relative to the project. Forbidden zones are judged on the path inside each repository too.
+export async function diffCheckpoint(root, checkpoint) {
+  const outer = await diffOne(root, checkpoint, '', checkpoint.exclude ?? []);
+  const parts = [outer];
+  for (const part of checkpoint.nested ?? []) {
+    try { parts.push(await diffOne(join(root, part.dir), part, `${part.dir}/`)); } catch { /* left alone */ }
+  }
+  const files = parts.flatMap((part) => part.files);
+  const stat = parts.map((part) => part.stat).filter(Boolean).join('\n');
+  const forbiddenIn = (path) => isForbidden(path) || (checkpoint.nested ?? []).some((part) => path.startsWith(`${part.dir}/`) && isForbidden(path.slice(part.dir.length + 1)));
+  return { afterTree: outer.afterTree ?? null, files, stat, forbidden: files.filter((file) => forbiddenIn(file.path)).map((file) => file.path) };
+}
+
+// Which repository a project-relative path belongs to, and the path inside it.
+function repoFor(root, checkpoint, path) {
+  for (const part of checkpoint.nested ?? []) {
+    if (path.startsWith(`${part.dir}/`)) return { dir: join(root, part.dir), commit: part.commit, inner: path.slice(part.dir.length + 1) };
+  }
+  return { dir: root, commit: checkpoint.commit, inner: path };
 }
 
 // Put the working tree back to the checkpoint: files added since are removed,
@@ -83,18 +177,20 @@ export async function restoreCheckpoint(root, checkpoint, { paths = null } = {})
   for (const file of chosen) {
     const absolute = resolve(root, file.path);
     if (!absolute.startsWith(canonicalRoot + sep)) continue;
+    const repo = repoFor(root, checkpoint, file.path);
     if (file.status === 'A') {
       await unlink(absolute).catch(() => {});
       removed.push(file.path);
     } else {
       if (file.status === 'R' && file.from) {
         await unlink(absolute).catch(() => {});
-        await git(root, ['restore', '--source', checkpoint.commit, '--worktree', '--', file.from]);
+        const origin = repoFor(root, checkpoint, file.from);
+        await git(origin.dir, ['restore', '--source', origin.commit, '--worktree', '--', origin.inner]);
         restored.push(file.from);
         removed.push(file.path);
         continue;
       }
-      await git(root, ['restore', '--source', checkpoint.commit, '--worktree', '--', file.path]);
+      await git(repo.dir, ['restore', '--source', repo.commit, '--worktree', '--', repo.inner]);
       restored.push(file.path);
     }
   }
@@ -103,4 +199,5 @@ export async function restoreCheckpoint(root, checkpoint, { paths = null } = {})
 
 export async function dropCheckpoint(root, checkpoint) {
   await git(root, ['update-ref', '-d', `${CHECKPOINT_REF}/${checkpoint.id}`]).catch(() => {});
+  for (const part of checkpoint.nested ?? []) await git(join(root, part.dir), ['update-ref', '-d', `${CHECKPOINT_REF}/${checkpoint.id}`]).catch(() => {});
 }

package/src/conversation-context.mjs

@@ -17,9 +17,11 @@ export function messageEntry(event) {
   return { sequence: event.sequence, messageId, role, sender, target, text: text.trim() };
 }
 
-export function buildConversationContext(events, { excludeMessageId, maxChars = 16000 } = {}) {
+// `omitSynthetic` drops MADRE's own canned replies (identity, refusals, round-table plans):
+// @madre must never read them back, or a small model starts echoing them.
+export function buildConversationContext(events, { excludeMessageId, maxChars = 16000, omitSynthetic = false } = {}) {
   const messages = events
-    .map(messageEntry)
+    .map((event) => (omitSynthetic && event?.payload?.synthetic ? null : messageEntry(event)))
     .filter((message) => message && message.messageId !== excludeMessageId);
   const selected = [];
   let remaining = Math.max(0, Number(maxChars) || 0);