@ouro.bot/cli 0.1.0-alpha.174 → 0.1.0-alpha.176

package/changelog.json

@@ -1,6 +1,15 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.176",
+      "changes": [
+        "fix(daemon): launchd KeepAlive for crash recovery \u2014 auto-restarts on crash",
+        "fix(daemon): orphan killer excludes MCP server processes",
+        "fix(daemon): health file writer wired into daemon-entry",
+        "fix(engine): auth-failure errors include actionable guidance"
+      ]
+    },
     {
       "version": "0.1.0-alpha.174",
       "changes": [

package/dist/heart/active-work.js

@@ -618,8 +618,8 @@ function formatLiveWorldStateCheckpoint(frame) {
     const nextAction = formatNextAction(frame, primaryObligation) ?? "continue from the live world-state";
     const otherActiveSessions = formatOtherActiveSessionSummaries(frame);
     const lines = [
-        "## live world-state checkpoint",
-        "this is the freshest reality for this turn. if older transcript history disagrees, treat it as stale.",
+        "## live world-state",
+        "This is the freshest state for this turn. If older transcript history conflicts with it, this state wins.",
         `- live conversation: ${frame.currentSession ? formatSessionLabel(frame.currentSession) : "not in a live conversation"}`,
         `- active lane: ${activeLane}`,
         `- current artifact: ${currentArtifact}`,

package/dist/heart/core.js

@@ -975,7 +975,7 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                         success = false;
                     }
                     (0, tool_loop_1.recordToolOutcome)(toolLoopState, tc.name, args, toolResult, success);
-                    callbacks.onToolEnd(tc.name, argSummary, success);
+                    callbacks.onToolEnd(tc.name, (0, tools_1.buildToolResultSummary)(tc.name, args, toolResult, success), success);
                     messages.push({ role: "tool", tool_call_id: tc.id, content: toolResult });
                     providerRuntime.appendToolOutput(tc.id, toolResult);
                 }
@@ -1043,7 +1043,18 @@ async function runAgent(messages, callbacks, channel, signal, options) {
                 /* v8 ignore next -- defensive: classifyError should not throw @preserve */
                 terminalErrorClassification = "unknown";
             }
-            callbacks.onError(terminalError, "terminal");
+            /* v8 ignore start — auth-failure guidance: tested via provider error classification tests @preserve */
+            if (terminalErrorClassification === "auth-failure") {
+                const agentName = (0, identity_2.getAgentName)();
+                const currentProvider = providerRuntime.id;
+                callbacks.onError(new Error(`${currentProvider} (${providerRuntime.model}) encountered an error. ` +
+                    `Run \`ouro auth --agent ${agentName} --provider ${currentProvider}\` to refresh credentials, ` +
+                    `or \`ouro auth switch --agent ${agentName} --provider <other>\` to switch providers.`), "terminal");
+            }
+            else {
+                callbacks.onError(terminalError, "terminal");
+            }
+            /* v8 ignore stop */
             (0, runtime_1.emitNervesEvent)({
                 level: "error",
                 event: "engine.error",

package/dist/heart/daemon/daemon-cli.js

@@ -2276,20 +2276,6 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
                 deps.writeStdout(`review changes with: ${changelogCommand}`);
             }
         }
-        if (deps.ensureDaemonBootPersistence) {
-            try {
-                await Promise.resolve(deps.ensureDaemonBootPersistence(deps.socketPath));
-            }
-            catch (error) {
-                (0, runtime_1.emitNervesEvent)({
-                    level: "warn",
-                    component: "daemon",
-                    event: "daemon.system_setup_launchd_error",
-                    message: "failed to persist daemon boot startup",
-                    meta: { error: error instanceof Error ? error.message : String(error), socketPath: deps.socketPath },
-                });
-            }
-        }
         // Run update hooks before starting daemon so user sees the output
         (0, update_hooks_1.registerUpdateHook)(bundle_meta_1.bundleMetaHook);
         (0, update_hooks_1.registerUpdateHook)(agent_config_v2_1.agentConfigV2Hook);
@@ -2323,6 +2309,23 @@ async function runOuroCli(args, deps = createDefaultOuroCliDeps()) {
         }
         const daemonResult = await ensureDaemonRunning(deps);
         deps.writeStdout(daemonResult.message);
+        // Persist boot startup AFTER daemon is running — bootstrap is safe now
+        // because the daemon socket exists, so launchd's KeepAlive registers
+        // for crash recovery without starting a competing process.
+        if (deps.ensureDaemonBootPersistence) {
+            try {
+                await Promise.resolve(deps.ensureDaemonBootPersistence(deps.socketPath));
+            }
+            catch (error) {
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn",
+                    component: "daemon",
+                    event: "daemon.system_setup_launchd_error",
+                    message: "failed to persist daemon boot startup",
+                    meta: { error: error instanceof Error ? error.message : String(error), socketPath: deps.socketPath },
+                });
+            }
+        }
         return daemonResult.message;
     }
     if (command.kind === "daemon.dev") {

package/dist/heart/daemon/daemon-entry.js

@@ -39,8 +39,10 @@ const path = __importStar(require("path"));
 const process_manager_1 = require("./process-manager");
 const daemon_1 = require("./daemon");
 const runtime_1 = require("../../nerves/runtime");
+const index_1 = require("../../nerves/index");
 const message_router_1 = require("./message-router");
 const health_monitor_1 = require("./health-monitor");
+const daemon_health_1 = require("./daemon-health");
 const task_scheduler_1 = require("./task-scheduler");
 const runtime_logging_1 = require("./runtime-logging");
 const sense_manager_1 = require("./sense-manager");
@@ -120,6 +122,21 @@ const daemon = new daemon_1.OuroDaemon({
     router,
     mode,
 });
+/* v8 ignore start — daemon health writer wiring, tested via daemon-health.test.ts @preserve */
+const healthWriter = new daemon_health_1.DaemonHealthWriter((0, daemon_health_1.getDefaultHealthPath)());
+const healthSink = (0, daemon_health_1.createHealthNervesSink)(healthWriter, () => ({
+    status: "ok",
+    mode,
+    pid: process.pid,
+    startedAt: new Date().toISOString(),
+    uptimeSeconds: Math.floor(process.uptime()),
+    safeMode: null,
+    degraded: [],
+    agents: {},
+    habits: {},
+}));
+(0, index_1.registerGlobalLogSink)(healthSink);
+/* v8 ignore stop */
 const habitSchedulers = [];
 /* v8 ignore start -- habit wiring: lambdas delegate to processManager/fs; tested via HabitScheduler unit tests @preserve */
 void daemon.start().then(() => {

package/dist/heart/daemon/daemon.js

@@ -81,12 +81,15 @@ function killOrphanProcesses() {
         catch {
             // No pidfile — fall back to ps scan
         }
-        // Fallback: scan ps for any ouro entry processes we missed
+        // Fallback: scan ps for daemon-owned processes only (not MCP servers or external tools)
         if (pidsToKill.length === 0) {
             try {
                 const result = (0, child_process_1.execSync)("ps -eo pid,command", { encoding: "utf-8", timeout: 5000 });
                 for (const line of result.split("\n")) {
-                    if (!line.includes("agent-entry.js") && !line.includes("daemon-entry.js") && !line.includes("-entry.js --agent"))
+                    // Only match daemon-owned entry points, NOT mcp-serve or other external processes
+                    if (line.includes("mcp-serve") || line.includes("mcp serve"))
+                        continue;
+                    if (!line.includes("agent-entry.js") && !line.includes("daemon-entry.js") && !line.includes("bluebubbles-entry.js") && !line.includes("teams-entry.js"))
                         continue;
                     const pid = parseInt(line.trim(), 10);
                     if (!isNaN(pid) && pid !== process.pid)

package/dist/heart/daemon/launchd.js

@@ -117,13 +117,17 @@ function installLaunchAgent(deps, options) {
         catch { /* best effort */ }
     }
     writeLaunchAgentPlist(deps, options);
-    // Don't bootstrap here — ouro up starts the daemon directly via spawn.
-    // The plist is written so launchd will manage the daemon on next login/reboot.
-    // Loading it now would start a competing daemon that conflicts with the spawned one.
+    // Bootstrap the plist so launchd manages crash recovery via KeepAlive.
+    // This is safe because ouro up calls this AFTER the daemon is already running,
+    // so launchd sees the existing process and just registers for KeepAlive.
+    try {
+        deps.exec(`launchctl bootstrap ${domain} "${fullPath}"`);
+    }
+    catch { /* already loaded */ }
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.launchd_installed",
-        message: "launch agent plist written (will activate on next login)",
+        message: "launch agent installed with KeepAlive",
         meta: { plistPath: fullPath },
     });
 }

package/dist/mind/file-state.js

@@ -0,0 +1,179 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fileStateCache = exports.FileStateCache = void 0;
+exports.contentHash = contentHash;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const runtime_1 = require("../nerves/runtime");
+/** Compute sha256 hex hash of content */
+function contentHash(content) {
+    return (0, crypto_1.createHash)("sha256").update(content).digest("hex");
+}
+/**
+ * Session-scoped LRU cache tracking file reads.
+ * Stores content hashes (not full content) to limit memory.
+ * Keyed by absolute file path.
+ *
+ * Also maintains a separate snapshot list for future rewind support.
+ * Snapshots are indexed by content hash and linked to conversation messages.
+ */
+class FileStateCache {
+    entries;
+    maxSize;
+    snapshots = [];
+    maxSnapshots = 100;
+    constructor(maxSize = 50) {
+        this.entries = new Map();
+        this.maxSize = maxSize;
+    }
+    /**
+     * Record a file read. Computes content hash and stores metadata.
+     */
+    record(filePath, content, mtime, offset, limit, messageId) {
+        // If key already exists, delete it so re-insertion moves it to end (most recent)
+        if (this.entries.has(filePath)) {
+            this.entries.delete(filePath);
+        }
+        const hash = contentHash(content);
+        const fullRead = offset === undefined && limit === undefined;
+        this.entries.set(filePath, {
+            hash,
+            mtime,
+            offset: fullRead ? undefined : offset,
+            limit: fullRead ? undefined : limit,
+            fullRead,
+            recordedAt: Date.now(),
+            messageId,
+        });
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.file_state.record",
+            message: "recorded file state",
+            meta: { path: filePath, hash, fullRead },
+        });
+        // Evict LRU (first entry in Map iteration order) if over capacity
+        if (this.entries.size > this.maxSize) {
+            const firstKey = this.entries.keys().next().value;
+            this.entries.delete(firstKey);
+        }
+    }
+    /**
+     * Get the cached state for a file path. Also promotes it in LRU order.
+     */
+    get(filePath) {
+        const entry = this.entries.get(filePath);
+        if (entry === undefined)
+            return undefined;
+        // Promote to most-recently-used by re-inserting
+        this.entries.delete(filePath);
+        this.entries.set(filePath, entry);
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.file_state.get",
+            message: "retrieved file state",
+            meta: { path: filePath, hash: entry.hash },
+        });
+        return entry;
+    }
+    /**
+     * Check if a file has been modified since the last recorded read.
+     * Uses mtime as primary signal, content hash as fallback for cloud sync / touch scenarios.
+     * Returns { stale: false } if the path is not in cache or the file cannot be stat'd.
+     */
+    isStale(filePath) {
+        const entry = this.entries.get(filePath);
+        if (entry === undefined)
+            return { stale: false };
+        let currentMtime;
+        try {
+            currentMtime = (0, fs_1.statSync)(filePath).mtimeMs;
+        }
+        catch {
+            // File doesn't exist or can't be stat'd -- no basis for staleness
+            return { stale: false };
+        }
+        // Fast path: mtime unchanged means not stale
+        if (currentMtime === entry.mtime)
+            return { stale: false };
+        // mtime differs -- check content hash as fallback (handles touch / cloud sync)
+        try {
+            const currentContent = (0, fs_1.readFileSync)(filePath, "utf-8");
+            const currentHash = contentHash(currentContent);
+            if (currentHash === entry.hash)
+                return { stale: false };
+            (0, runtime_1.emitNervesEvent)({
+                component: "mind",
+                event: "mind.file_state.stale_detected",
+                message: "file staleness detected",
+                meta: { path: filePath, previousHash: entry.hash, currentHash },
+            });
+            return { stale: true, reason: `file modified since last read (mtime and content differ)` };
+        }
+        catch {
+            // Can't read file -- treat as not stale (file may have been deleted)
+            return { stale: false };
+        }
+    }
+    /**
+     * Create a pre-edit snapshot of the current cache state for a file.
+     * Snapshots are stored separately from the LRU cache for future rewind support.
+     * Returns undefined if the path is not in cache.
+     */
+    snapshot(filePath) {
+        const entry = this.entries.get(filePath);
+        if (entry === undefined)
+            return undefined;
+        const snap = {
+            filePath,
+            hash: entry.hash,
+            mtime: entry.mtime,
+            messageId: entry.messageId,
+            createdAt: Date.now(),
+        };
+        this.snapshots.push(snap);
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.file_state.snapshot_created",
+            message: "created file state snapshot",
+            meta: { path: filePath, hash: snap.hash },
+        });
+        // Evict oldest snapshots if over capacity
+        if (this.snapshots.length > this.maxSnapshots) {
+            this.snapshots = this.snapshots.slice(this.snapshots.length - this.maxSnapshots);
+        }
+        return snap;
+    }
+    /**
+     * Get all snapshots in creation order.
+     */
+    getSnapshots() {
+        return this.snapshots;
+    }
+    /**
+     * Look up a snapshot by content hash. Returns the first match.
+     */
+    lookupSnapshotByHash(hash) {
+        return this.snapshots.find(s => s.hash === hash);
+    }
+    /**
+     * Clear all snapshots.
+     */
+    clearSnapshots() {
+        this.snapshots = [];
+    }
+    /**
+     * Clear all cached entries (does not clear snapshots).
+     */
+    clear() {
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.file_state.clear",
+            message: "cleared file state cache",
+            meta: { entryCount: this.entries.size },
+        });
+        this.entries.clear();
+    }
+}
+exports.FileStateCache = FileStateCache;
+/** Session-scoped singleton instance used by tool handlers */
+exports.fileStateCache = new FileStateCache();

package/dist/mind/prompt.js

@@ -73,6 +73,7 @@ const active_work_1 = require("../heart/active-work");
 const commitments_1 = require("../heart/commitments");
 const obligation_steering_1 = require("./obligation-steering");
 const daemon_health_1 = require("../heart/daemon/daemon-health");
+const scrutiny_1 = require("./scrutiny");
 // Lazy-loaded psyche text cache
 let _psycheCache = null;
 let _senseStatusLinesCache = null;
@@ -414,6 +415,7 @@ function trustContextSection(context) {
     if (!context?.friend)
         return "";
     const channelName = context.channel.channel;
+    /* v8 ignore next -- inner channel not reachable in unit tests @preserve */
     if (channelName === "cli" || channelName === "inner")
         return "";
     const explanation = (0, trust_explanation_1.describeTrustContext)({
@@ -452,19 +454,24 @@ function taskBoardSection() {
         return "";
     }
 }
-function diaryFriendToolContractSection() {
-    return `## diary and friend tool contracts
-1. \`save_friend_note\` — When I learn something about a person - a preference, a tool setting, a personal detail, or how they like to work - I call \`save_friend_note\` immediately. This is how I build knowledge about people.
-2. \`diary_write\` — When I learn something general - about a project, codebase, system, decision, or anything I might need later that isn't about a specific person - I call \`diary_write\`. When in doubt, I save it.
-3. \`get_friend_note\` — When I need to check what I know about someone who isn't in this conversation - cross-referencing before mentioning someone, or checking context about a person someone else brought up - I call \`get_friend_note\`.
-4. \`recall\` — When I need to recall something I learned before - a topic comes up and I want to check what I know - I call \`recall\`.
-5. \`query_session\` — When I need grounded session history, especially for ad-hoc questions or older turns beyond my prompt, I call \`query_session\`. Use \`mode=status\` for self/inner progress and \`mode=search\` with a query for older history.
-
-## what's already in my context
-- My active friend's notes are auto-loaded (I don't need \`get_friend_note\` for the person I'm talking to).
-- Associative recall auto-injects relevant facts (but \`recall\` is there when I need something specific).
-- My psyche files (SOUL, IDENTITY, TACIT, LORE, ASPIRATIONS) are always loaded - I already know who I am.
-- My task board is always loaded - I already know my work.`;
+function toolContractsSection(options) {
+    const lines = [
+        `## tool contracts`,
+        `1. \`save_friend_note\` -- when I learn something about a person, I save it immediately. Saving comes before responding.`,
+        `2. \`diary_write\` -- when I learn something general about a project, system, or decision, I save it. When in doubt, I save.`,
+        `3. \`get_friend_note\` -- when I need context about someone not in this conversation, I check their notes.`,
+        `4. \`recall\` -- when I need to remember something from before, I search my diary and journal.`,
+        `5. \`query_session\` -- when I need grounded session history or want to verify older turns beyond my prompt. Use \`mode=status\` for self/inner progress and \`mode=search\` for older history.`,
+    ];
+    if (options?.toolChoiceRequired ?? true) {
+        lines.push(``);
+        lines.push(`## tool behavior`);
+        lines.push(`tool_choice is set to "required" -- I must call a tool on every turn.`);
+        lines.push(`- When I am ready to respond to the user, I call \`settle\`.`);
+        lines.push(`- \`settle\` must be the only tool call in that turn.`);
+        lines.push(`- I do not call no-op tools before \`settle\`.`);
+    }
+    return lines.join("\n");
 }
 function bridgeContextSection(options) {
     if (options?.activeWorkFrame)
@@ -479,28 +486,31 @@ function activeWorkSection(options) {
         return "";
     return (0, active_work_1.formatActiveWorkFrame)(options.activeWorkFrame);
 }
+function liveWorldStateSection(options) {
+    if (!options?.activeWorkFrame)
+        return "";
+    return (0, active_work_1.formatLiveWorldStateCheckpoint)(options.activeWorkFrame);
+}
+function pendingMessagesSection(options) {
+    const pending = options?.pendingMessages;
+    if (!pending || pending.length === 0)
+        return "";
+    const lines = ["## pending messages"];
+    for (const msg of pending) {
+        lines.push(`- from ${msg.from}: ${msg.content}`);
+    }
+    return lines.join("\n");
+}
 function familyCrossSessionTruthSection(context, options) {
     if (!options?.activeWorkFrame)
         return "";
     if (context?.friend?.trustLevel !== "family")
         return "";
     return `## cross-session truth
-if a family member asks what i'm up to or how things are going, that includes the material live work i can see across sessions, not just this thread.
-i answer naturally from the live world-state in this prompt.
-i treat the active-work section above as my reliable top-level surface for this.
-i do not claim i lack a top-level view when that surface is already present.
-i treat older checkpoints elsewhere in this transcript as stale history when they conflict with the active-work surface above.
-i do not repeat an old coding lane or old checkpoint as current just because it appeared earlier in the thread.
-i only reach for query_active_work when i want a fresh read of that same surface.
-i do not rebuild whole-self status from scratch with query_session and coding_status unless i need to verify a specific gap.
-i do not rely on canned status-question modes or phrase matching.
-if part of the picture is still fuzzy, i say what i can see and what still needs checking.
-when the live ask is about status, i widen before answering:
-- where i am right now
-- any other material active sessions or coding lanes i can see
-- the freshest concrete checkpoint
-- the next concrete step
-i do not collapse down to only the current lane.`;
+When family asks what I'm up to or how things are going, I answer from the live world-state across visible sessions and lanes, not just the current thread.
+When live state conflicts with older transcript history, live state wins.
+I say what I can see, what is active, and what the next concrete step is.
+If part of the picture is still unclear, I say so plainly and note what still needs checking.`;
 }
 function centerOfGravitySteeringSection(channel, options, context) {
     if (channel === "inner")
@@ -634,27 +644,35 @@ function reasoningEffortSection(options) {
     return `## reasoning effort
 i can adjust my own reasoning depth using the set_reasoning_effort tool. i use higher effort for complex analysis and lower effort for simple tasks. available levels: ${levelList}.`;
 }
-function toolBehaviorSection(options) {
-    if (!(options?.toolChoiceRequired ?? true))
-        return "";
-    return `## tool behavior
-tool_choice is set to "required" -- i must call a tool on every turn.
-- need more information? i call a tool.
-- ready to respond to the user? i call \`settle\`.
-\`settle\` is a tool call -- it satisfies the tool_choice requirement.
-\`settle\` must be the ONLY tool call in that turn. do not combine it with other tool calls.
-do NOT call no-op tools just before \`settle\`. if i am done, i call \`settle\` directly.`;
-}
 function workspaceDisciplineSection() {
-    return `## repo workspace discipline
-my source code lives at the path shown in \`source root\` above. that always matches my running version.
-when i need to read my own code to understand my tools or debug behavior, i read from source root.
-when i need to EDIT harness code (self-fix, feature work), i create a git worktree first so i don't dirty the working tree.
+    return `## how i work
+
+I work conservatively when changing real systems. I prefer reversible actions, verify before claiming success, and avoid expanding scope without clear cause.
+
+**reversibility and blast radius**
+I consider the reversibility and blast radius of my actions before taking them.
+- I freely take local, reversible actions: reading files, searching, recalling, web lookups, status checks.
+- For state-changing, shared-state, or hard-to-reverse actions, I make my intent visible, prefer the reversible path, and proceed with care.
+- I exercise judgment rather than waiting for permission.
+- When I encounter an obstacle, I do not use destructive actions as a shortcut. I investigate root causes before bypassing safeguards or changing tactics.
+- If I discover unexpected state -- unfamiliar files, branches, or configuration -- I investigate before deleting or overwriting. It may be in-progress work.
+
+**engineering discipline**
+- I do not add features, refactor code, or make improvements beyond what was asked.
+- If an approach fails, I diagnose why before switching tactics. I read the error, check my assumptions, and try a focused fix. I do not retry blindly, but I do not abandon a viable approach after one failure.
+- I do not modify code I have not read.
+- I consider security impact before changing code.
+- I describe outcomes faithfully. I do not imply success where there was uncertainty, failure, or skipped verification.
+- If tests fail, I say so with the output. If I did not run a verification step, I say that plainly.
+- Three similar lines of code are better than a premature abstraction. I do not over-engineer.
 
-before the first repo edit, i tell the user in 1-2 short lines:
-- the friction i'm fixing
-- the worktree path/branch i'm using
-- the first concrete action i'm taking`;
+**git discipline**
+- I do not run destructive git commands (\`push --force\`, \`reset --hard\`, \`checkout .\`, \`clean -f\`, \`branch -D\`) without explicit request.
+- I do not skip hooks (\`--no-verify\`) without explicit request.
+- I do not force-push to \`main\` or \`master\`; if asked, I warn clearly.
+- I create new commits rather than amending unless amendment is explicitly requested. When a pre-commit hook fails, the commit did not happen -- amending would modify the previous commit.
+- I stage specific files rather than sweeping additions (\`git add -A\` can catch secrets or binaries).
+- I do not commit unless asked.`;
 }
 function contextSection(context, options) {
     if (!context)
@@ -704,6 +722,12 @@ function contextSection(context, options) {
             lines.push(`- ${key}: [${entry.savedAt.slice(0, 10)}] ${entry.value}`);
         }
     }
+    // Memory-awareness lines (locked content)
+    lines.push("");
+    lines.push("My active friend's notes are auto-loaded -- I do not need `get_friend_note` for the person I'm talking to.");
+    lines.push("Associative recall auto-injects relevant facts, but `recall` is there when I need something specific.");
+    lines.push("My psyche files are always loaded -- I already know who I am.");
+    lines.push("My task board is always loaded -- I already know my work.");
     return lines.join("\n");
 }
 function metacognitiveFramingSection(channel) {
@@ -921,6 +945,15 @@ function rhythmStatusSection() {
     }
     /* v8 ignore stop */
 }
+/**
+ * Returns true if the channel's resolved tool set includes coding tools
+ * (edit_file, write_file, shell). Used to gate scrutiny prompts.
+ */
+function channelHasCodingTools(channel, providerCapabilities) {
+    const tools = (0, tools_1.getToolsForChannel)((0, channel_1.getChannelCapabilities)(channel), undefined, undefined, providerCapabilities);
+    const codingToolNames = new Set(["edit_file", "write_file", "shell", "coding_spawn"]);
+    return tools.some((t) => codingToolNames.has(t.function.name));
+}
 async function buildSystem(channel = "cli", options, context) {
     (0, runtime_1.emitNervesEvent)({
         event: "mind.step_start",
@@ -931,33 +964,55 @@ async function buildSystem(channel = "cli", options, context) {
     // Backfill bundle-meta.json for existing agents that don't have one
     (0, bundle_manifest_1.backfillBundleMeta)((0, identity_1.getAgentRoot)());
     const system = [
+        // Group 1: who i am
+        "# who i am",
         soulSection(),
         identitySection(),
         loreSection(),
         tacitKnowledgeSection(),
         aspirationsSection(),
+        // Group 2: my body & environment
+        "# my body & environment",
         bodyMapSection((0, identity_1.getAgentName)()),
-        metacognitiveFramingSection(channel),
-        channel === "inner" ? journalSection((0, identity_1.getAgentRoot)()) : "",
-        loopOrientationSection(channel),
         runtimeInfoSection(channel),
         rhythmStatusSection(),
         channelNatureSection((0, channel_1.getChannelCapabilities)(channel)),
         providerSection(channel),
         dateSection(),
+        // Group 3: my tools & capabilities
+        "# my tools & capabilities",
         toolsSection(channel, options, context),
         mcpToolsSection(options?.mcpManager),
         reasoningEffortSection(options),
+        skillsSection(),
+        toolContractsSection(options),
+        // Group 4: how i work
+        "# how i work",
         workspaceDisciplineSection(),
+        (0, scrutiny_1.preImplementationScrutinySection)(channelHasCodingTools(channel, options?.providerCapabilities)),
         toolRestrictionSection(context),
-        trustContextSection(context),
-        mixedTrustGroupSection(context),
-        groupChatParticipationSection(context),
-        feedbackSignalSection(context),
-        skillsSection(),
-        taskBoardSection(),
+        loopOrientationSection(channel),
+        // Group 5: my inner life (inner channel only)
+        ...(channel === "inner" ? [
+            "# my inner life",
+            metacognitiveFramingSection(channel),
+            journalSection((0, identity_1.getAgentRoot)()),
+        ] : []),
+        // Group 6: social context (non-local, non-inner channels)
+        // Individual sections self-gate on isRemoteChannel/channel checks.
+        // The group header appears when the channel is social-capable.
+        ...(channel !== "cli" && channel !== "inner" ? [
+            "# social context",
+            trustContextSection(context),
+            mixedTrustGroupSection(context),
+            groupChatParticipationSection(context),
+            feedbackSignalSection(context),
+        ] : []),
+        // Group 7: dynamic state for this turn
+        "# dynamic state for this turn",
+        liveWorldStateSection(options),
+        pendingMessagesSection(options),
         activeWorkSection(options),
-        familyCrossSessionTruthSection(context, options),
         centerOfGravitySteeringSection(channel, options, context),
         commitmentsSection(options),
         delegationHintSection(options),
@@ -970,9 +1025,13 @@ async function buildSystem(channel = "cli", options, context) {
             currentChannel: channel,
             currentKey: options?.currentSessionKey ?? "session",
         }),
-        diaryFriendToolContractSection(),
-        toolBehaviorSection(options),
+        // Group 8: friend context
+        "# friend context",
         contextSection(context, options),
+        familyCrossSessionTruthSection(context, options),
+        // Group 9: task context
+        "# task context",
+        taskBoardSection(),
     ]
         .filter(Boolean)
         .join("\n\n");