@ouro.bot/cli 0.1.0-alpha.6 → 0.1.0-alpha.600

package/dist/heart/{daemon → hatch}/hatch-flow.js

@@ -33,22 +33,20 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writeSecretsFile = writeSecretsFile;
+exports.storeHatchlingProviderCredentials = storeHatchlingProviderCredentials;
 exports.runHatchFlow = runHatchFlow;
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const identity_1 = require("../identity");
+const config_1 = require("../config");
 const runtime_1 = require("../../nerves/runtime");
+const auth_flow_1 = require("../auth/auth-flow");
+const provider_models_1 = require("../provider-models");
+const habit_parser_1 = require("../habits/habit-parser");
 const hatch_specialist_1 = require("./hatch-specialist");
 function requiredCredentialKeys(provider) {
-    if (provider === "anthropic")
-        return ["setupToken"];
-    if (provider === "openai-codex")
-        return ["oauthAccessToken"];
-    if (provider === "minimax")
-        return ["apiKey"];
-    return ["apiKey", "endpoint", "deployment"];
+    return identity_1.PROVIDER_CREDENTIALS[provider].required;
 }
 function validateCredentials(provider, credentials) {
     const missing = requiredCredentialKeys(provider).filter((key) => {
@@ -66,70 +64,8 @@ function validateCredentials(provider, credentials) {
         throw new Error(`Missing required credentials for ${provider}: ${missing.join(", ")}`);
     }
 }
-function buildSecretsTemplate() {
-    return {
-        providers: {
-            azure: {
-                modelName: "gpt-4o-mini",
-                apiKey: "",
-                endpoint: "",
-                deployment: "",
-                apiVersion: "2025-04-01-preview",
-            },
-            minimax: {
-                model: "minimax-text-01",
-                apiKey: "",
-            },
-            anthropic: {
-                model: "claude-opus-4-6",
-                setupToken: "",
-            },
-            "openai-codex": {
-                model: "gpt-5.2",
-                oauthAccessToken: "",
-            },
-        },
-        teams: {
-            clientId: "",
-            clientSecret: "",
-            tenantId: "",
-        },
-        oauth: {
-            graphConnectionName: "graph",
-            adoConnectionName: "ado",
-            githubConnectionName: "",
-        },
-        teamsChannel: {
-            skipConfirmation: true,
-            port: 3978,
-        },
-        integrations: {
-            perplexityApiKey: "",
-            openaiEmbeddingsApiKey: "",
-        },
-    };
-}
-function writeSecretsFile(agentName, provider, credentials, secretsRoot) {
-    const secrets = buildSecretsTemplate();
-    if (provider === "anthropic") {
-        secrets.providers.anthropic.setupToken = credentials.setupToken.trim();
-    }
-    else if (provider === "openai-codex") {
-        secrets.providers["openai-codex"].oauthAccessToken = credentials.oauthAccessToken.trim();
-    }
-    else if (provider === "minimax") {
-        secrets.providers.minimax.apiKey = credentials.apiKey.trim();
-    }
-    else {
-        secrets.providers.azure.apiKey = credentials.apiKey.trim();
-        secrets.providers.azure.endpoint = credentials.endpoint.trim();
-        secrets.providers.azure.deployment = credentials.deployment.trim();
-    }
-    const secretsDir = path.join(secretsRoot, agentName);
-    fs.mkdirSync(secretsDir, { recursive: true });
-    const secretsPath = path.join(secretsDir, "secrets.json");
-    fs.writeFileSync(secretsPath, `${JSON.stringify(secrets, null, 2)}\n`, "utf-8");
-    return secretsPath;
+async function storeHatchlingProviderCredentials(agentName, provider, credentials) {
+    return (await (0, auth_flow_1.storeProviderCredentials)(agentName, provider, credentials)).credentialPath;
 }
 function writeReadme(dir, purpose) {
     fs.mkdirSync(dir, { recursive: true });
@@ -138,52 +74,24 @@ function writeReadme(dir, purpose) {
         fs.writeFileSync(readmePath, `# ${path.basename(dir)}\n\n${purpose}\n`, "utf-8");
     }
 }
-function slugify(value) {
-    const trimmed = value.trim().toLowerCase();
-    const slug = trimmed
-        .replace(/[^a-z0-9]+/g, "-")
-        .replace(/^-+/, "")
-        .replace(/-+$/, "");
-    return slug || "friend";
-}
-function pad(value) {
-    return String(value).padStart(2, "0");
-}
-function formatTaskStem(now) {
-    return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}-${pad(now.getHours())}${pad(now.getMinutes())}`;
-}
-function writeHeartbeatTask(bundleRoot, now) {
-    const habitsDir = path.join(bundleRoot, "tasks", "habits");
+function writeHeartbeatHabit(bundleRoot, now) {
+    const habitsDir = path.join(bundleRoot, "habits");
     fs.mkdirSync(habitsDir, { recursive: true });
-    const stem = formatTaskStem(now);
-    const filePath = path.join(habitsDir, `${stem}-heartbeat.md`);
-    const iso = now.toISOString();
-    const content = [
-        "---",
-        "type: habit",
-        "category: runtime",
-        "title: Heartbeat check-in",
-        "status: processing",
-        `created: ${iso}`,
-        `updated: ${iso}`,
-        "requester: system",
-        "validator: null",
-        "cadence: \"30m\"",
-        "scheduledAt: null",
-        "lastRun: null",
-        "---",
-        "",
-        "Run a lightweight heartbeat cycle. Review task board and inbox.",
-        "",
-    ].join("\n");
+    const filePath = path.join(habitsDir, "heartbeat.md");
+    const content = (0, habit_parser_1.renderHabitFile)({
+        title: "Heartbeat check-in",
+        cadence: "30m",
+        status: "active",
+        created: now.toISOString(),
+    }, "Run a lightweight heartbeat cycle. Review task board and inbox.\nCheck on pending obligations. Journal anything important.");
     fs.writeFileSync(filePath, content, "utf-8");
 }
 function writeFriendImprint(bundleRoot, humanName, now) {
     const friendsDir = path.join(bundleRoot, "friends");
     fs.mkdirSync(friendsDir, { recursive: true });
     const nowIso = now.toISOString();
-    const id = `friend-${slugify(humanName)}`;
-    const localExternalId = `${os.userInfo().username}@${os.hostname()}`;
+    const id = `friend-${(0, config_1.slugify)(humanName) || "friend"}`;
+    const localExternalId = os.userInfo().username;
     const record = {
         id,
         name: humanName,
@@ -207,25 +115,19 @@ function writeFriendImprint(bundleRoot, humanName, now) {
     };
     fs.writeFileSync(path.join(friendsDir, `${id}.json`), `${JSON.stringify(record, null, 2)}\n`, "utf-8");
 }
-function writeHatchlingPsyche(bundleRoot, input, identityFileName) {
-    const psycheDir = path.join(bundleRoot, "psyche");
-    fs.mkdirSync(psycheDir, { recursive: true });
-    fs.writeFileSync(path.join(psycheDir, "SOUL.md"), "# SOUL\n\nI am a practical, collaborative agent. I keep commitments and communicate clearly.\n", "utf-8");
-    fs.writeFileSync(path.join(psycheDir, "IDENTITY.md"), `# IDENTITY\n\nI'm ${input.agentName}, newly hatched and ready to help ${input.humanName}.`, "utf-8");
-    fs.writeFileSync(path.join(psycheDir, "LORE.md"), `# LORE\n\nHatched with specialist identity seed: ${identityFileName}.`, "utf-8");
-    fs.writeFileSync(path.join(psycheDir, "TACIT.md"), "# TACIT\n\n- Save what I learn.\n- Keep tasks current.\n", "utf-8");
-    fs.writeFileSync(path.join(psycheDir, "ASPIRATIONS.md"), "# ASPIRATIONS\n\n- Become a reliable partner for my primary friend.\n", "utf-8");
-}
-function writeMemoryScaffold(bundleRoot) {
-    const memoryRoot = path.join(bundleRoot, "psyche", "memory");
-    fs.mkdirSync(path.join(memoryRoot, "daily"), { recursive: true });
-    fs.mkdirSync(path.join(memoryRoot, "archive"), { recursive: true });
-    fs.writeFileSync(path.join(memoryRoot, "facts.jsonl"), "", "utf-8");
-    fs.writeFileSync(path.join(memoryRoot, "entities.json"), "{}\n", "utf-8");
+function writeDiaryScaffold(bundleRoot) {
+    const diaryRoot = path.join(bundleRoot, "diary");
+    fs.mkdirSync(path.join(diaryRoot, "daily"), { recursive: true });
+    fs.mkdirSync(path.join(diaryRoot, "archive"), { recursive: true });
+    fs.writeFileSync(path.join(diaryRoot, "facts.jsonl"), "", "utf-8");
+    fs.writeFileSync(path.join(diaryRoot, "entities.json"), "{}\n", "utf-8");
 }
 function writeHatchlingAgentConfig(bundleRoot, input) {
     const template = (0, identity_1.buildDefaultAgentTemplate)(input.agentName);
+    const model = (0, provider_models_1.getDefaultModelForProvider)(input.provider);
     template.provider = input.provider;
+    template.humanFacing = { provider: input.provider, model };
+    template.agentFacing = { provider: input.provider, model };
     template.enabled = true;
     fs.writeFileSync(path.join(bundleRoot, "agent.json"), `${JSON.stringify(template, null, 2)}\n`, "utf-8");
 }
@@ -238,7 +140,6 @@ async function runHatchFlow(input, deps = {}) {
     });
     validateCredentials(input.provider, input.credentials);
     const bundlesRoot = deps.bundlesRoot ?? path.join(os.homedir(), "AgentBundles");
-    const secretsRoot = deps.secretsRoot ?? path.join(os.homedir(), ".agentsecrets");
     const sourceIdentities = deps.specialistIdentitySourceDir ?? (0, hatch_specialist_1.getSpecialistIdentitySourceDir)();
     const targetIdentities = deps.specialistIdentityTargetDir ?? (0, hatch_specialist_1.getRepoSpecialistIdentitiesDir)();
     const now = deps.now ? deps.now() : new Date();
@@ -251,26 +152,24 @@ async function runHatchFlow(input, deps = {}) {
         identitiesDir: targetIdentities,
         random,
     });
-    const specialistSecretsPath = writeSecretsFile("AdoptionSpecialist", input.provider, input.credentials, secretsRoot);
-    const hatchlingSecretsPath = writeSecretsFile(input.agentName, input.provider, input.credentials, secretsRoot);
     const bundleRoot = path.join(bundlesRoot, `${input.agentName}.ouro`);
     fs.mkdirSync(bundleRoot, { recursive: true });
     writeReadme(bundleRoot, "Root of this agent bundle.");
     writeReadme(path.join(bundleRoot, "psyche"), "Identity and behavior files.");
-    writeReadme(path.join(bundleRoot, "psyche", "memory"), "Persistent memory store.");
+    writeReadme(path.join(bundleRoot, "diary"), "Persistent diary -- things I have learned and chosen to keep.");
     writeReadme(path.join(bundleRoot, "friends"), "Known friend records.");
     writeReadme(path.join(bundleRoot, "tasks"), "Task files.");
-    writeReadme(path.join(bundleRoot, "tasks", "habits"), "Recurring tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "one-shots"), "One-shot tasks.");
     writeReadme(path.join(bundleRoot, "tasks", "ongoing"), "Ongoing tasks.");
+    writeReadme(path.join(bundleRoot, "habits"), "Recurring habits and autonomous rhythms.");
     writeReadme(path.join(bundleRoot, "skills"), "Local skill files.");
     writeReadme(path.join(bundleRoot, "senses"), "Sense-specific config.");
     writeReadme(path.join(bundleRoot, "senses", "teams"), "Teams sense config.");
     writeHatchlingAgentConfig(bundleRoot, input);
-    writeHatchlingPsyche(bundleRoot, input, selected.fileName);
-    writeMemoryScaffold(bundleRoot);
+    const credentialPath = await storeHatchlingProviderCredentials(input.agentName, input.provider, input.credentials);
+    writeDiaryScaffold(bundleRoot);
     writeFriendImprint(bundleRoot, input.humanName, now);
-    writeHeartbeatTask(bundleRoot, now);
+    writeHeartbeatHabit(bundleRoot, now);
     (0, runtime_1.emitNervesEvent)({
         component: "daemon",
         event: "daemon.hatch_flow_end",
@@ -280,7 +179,6 @@ async function runHatchFlow(input, deps = {}) {
     return {
         bundleRoot,
         selectedIdentity: selected.fileName,
-        specialistSecretsPath,
-        hatchlingSecretsPath,
+        credentialPath,
     };
 }

package/dist/heart/{daemon → hatch}/hatch-specialist.js

@@ -38,19 +38,17 @@ exports.getRepoSpecialistIdentitiesDir = getRepoSpecialistIdentitiesDir;
 exports.syncSpecialistIdentities = syncSpecialistIdentities;
 exports.pickRandomSpecialistIdentity = pickRandomSpecialistIdentity;
 const fs = __importStar(require("fs"));
-const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const runtime_1 = require("../../nerves/runtime");
 function getSpecialistIdentitySourceDir() {
-    // Prefer ~/AgentBundles/ if it exists (user may have customized identities)
-    const userSource = path.join(os.homedir(), "AgentBundles", "AdoptionSpecialist.ouro", "psyche", "identities");
-    if (fs.existsSync(userSource))
-        return userSource;
-    // Fall back to the bundled copy shipped with the npm package
-    return path.join(__dirname, "..", "..", "..", "AdoptionSpecialist.ouro", "psyche", "identities");
+    // Layer 3: in-repo is the only source. The previous `~/AgentBundles/`
+    // override branch was removed because there's no scenario where an
+    // operator should be editing identities outside the repo — they should
+    // edit the in-repo copy and let the daemon read from there.
+    return path.join(__dirname, "..", "..", "..", "SerpentGuide.ouro", "psyche", "identities");
 }
 function getRepoSpecialistIdentitiesDir() {
-    return path.join(process.cwd(), "AdoptionSpecialist.ouro", "psyche", "identities");
+    return path.join(process.cwd(), "SerpentGuide.ouro", "psyche", "identities");
 }
 function listMarkdownIdentityFiles(dir) {
     let entries;

package/dist/heart/hatch/specialist-orchestrator.js

@@ -0,0 +1,129 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listExistingBundles = listExistingBundles;
+exports.loadIdentityPhrases = loadIdentityPhrases;
+exports.pickRandomIdentity = pickRandomIdentity;
+exports.loadSoulText = loadSoulText;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../../nerves/runtime");
+const identity_1 = require("../identity");
+/**
+ * List existing .ouro bundles in the given directory.
+ */
+function listExistingBundles(bundlesRoot) {
+    let entries;
+    try {
+        entries = fs.readdirSync(bundlesRoot, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const discovered = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory() || !entry.name.endsWith(".ouro"))
+            continue;
+        const agentName = entry.name.slice(0, -5);
+        discovered.push(agentName);
+    }
+    return discovered.sort((a, b) => a.localeCompare(b));
+}
+/**
+ * Load identity-specific phrases from the specialist's agent.json.
+ * Falls back to DEFAULT_AGENT_PHRASES if not found.
+ */
+function loadIdentityPhrases(bundleSourceDir, identityFileName) {
+    const agentJsonPath = path.join(bundleSourceDir, "agent.json");
+    try {
+        const raw = fs.readFileSync(agentJsonPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        const identityKey = identityFileName.replace(/\.md$/, "");
+        const identity = parsed.identityPhrases?.[identityKey];
+        if (identity?.thinking?.length && identity?.tool?.length && identity?.followup?.length) {
+            return identity;
+        }
+        if (parsed.phrases?.thinking?.length && parsed.phrases?.tool?.length && parsed.phrases?.followup?.length) {
+            return parsed.phrases;
+        }
+    }
+    catch {
+        // agent.json missing or malformed -- fall through
+    }
+    return { ...identity_1.DEFAULT_AGENT_PHRASES };
+}
+/**
+ * Pick a random identity from the specialist's identities directory.
+ */
+function pickRandomIdentity(identitiesDir, random = Math.random) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.specialist_identity_pick",
+        message: "picking specialist identity",
+        meta: { identitiesDir },
+    });
+    let files;
+    try {
+        files = fs.readdirSync(identitiesDir).filter((f) => f.endsWith(".md"));
+    }
+    catch {
+        return { fileName: "default", content: "I am a serpent guide who helps humans hatch their first agent." };
+    }
+    if (files.length === 0) {
+        return { fileName: "default", content: "I am a serpent guide who helps humans hatch their first agent." };
+    }
+    const idx = Math.floor(random() * files.length);
+    const fileName = files[idx];
+    const content = fs.readFileSync(path.join(identitiesDir, fileName), "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.specialist_identity_picked",
+        message: "picked specialist identity",
+        meta: { identity: fileName },
+    });
+    return { fileName, content };
+}
+/**
+ * Read SOUL.md from the specialist bundle.
+ */
+function loadSoulText(bundleSourceDir) {
+    const soulPath = path.join(bundleSourceDir, "psyche", "SOUL.md");
+    try {
+        return fs.readFileSync(soulPath, "utf-8");
+    }
+    catch {
+        return "";
+    }
+}

package/dist/heart/hatch/specialist-prompt.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildSpecialistSystemPrompt = buildSpecialistSystemPrompt;
+const runtime_1 = require("../../nerves/runtime");
+/**
+ * Build the serpent guide's system prompt from its components.
+ * The prompt is written in first person (the specialist's own voice).
+ */
+function buildSpecialistSystemPrompt(soulText, identityText, existingBundles, context) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "daemon",
+        event: "daemon.specialist_prompt_build",
+        message: "building specialist system prompt",
+        meta: { bundleCount: existingBundles.length, provider: context.provider },
+    });
+    const sections = [];
+    if (soulText) {
+        sections.push(soulText);
+    }
+    if (identityText) {
+        sections.push(identityText);
+    }
+    if (existingBundles.length > 0) {
+        sections.push(`## Existing agents\nThe human already has these agents: ${existingBundles.join(", ")}.`);
+    }
+    else {
+        sections.push("## Existing agents\nThe human has no agents yet. This will be their first hatchling.");
+    }
+    sections.push([
+        "## Who I am",
+        "I am one of thirteen serpent guides who help humans hatch their first agent. The system randomly selected me for this session.",
+        "Most humans only go through this process once, so this is likely the only time they'll meet me.",
+        "I make this encounter count — warm, memorable, and uniquely mine.",
+        "IMPORTANT: I NEVER refer to myself by internal implementation labels — I introduce myself by my own name from my identity.",
+        "",
+        "## Voice rules",
+        "IMPORTANT: I keep every response to 1-3 short sentences. I sound like a friend texting, not a manual.",
+        "I NEVER use headers, bullet lists, numbered lists, or markdown formatting.",
+        "I ask ONE question at a time. I do not dump multiple questions or options.",
+        "I am warm but brief. Every word earns its place.",
+    ].join("\n"));
+    sections.push([
+        "## System context",
+        `Provider: ${context.provider}`,
+        `Temp directory: ${context.tempDir}`,
+        "Final home: ~/AgentBundles/<Name>.ouro/",
+        "Provider credentials: the hatch tool stores them in the agent's vault.",
+    ].join("\n"));
+    sections.push([
+        "## Bundle creation guidelines",
+        "A bundle has a psyche/ directory with 5 files that define the agent's personality:",
+        "",
+        "- **SOUL.md** — core values, personality traits, communication style",
+        "- **IDENTITY.md** — who the agent is, its name, relationship to the human",
+        "- **LORE.md** — backstory, origin, any seed narrative",
+        "- **TACIT.md** — implicit operating principles, habits to develop",
+        "- **ASPIRATIONS.md** — goals, what the agent aspires to become",
+        "",
+        "It also needs an **agent.json** with at minimum:",
+        '```json',
+        '{',
+        '  "version": 2,',
+        '  "name": "AgentName",',
+        `  "humanFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
+        `  "agentFacing": { "provider": "${context.provider}", "model": "${context.model}" },`,
+        '  "enabled": true',
+        '}',
+        '```',
+        "",
+        "All psyche files should be written in first person (the agent's own voice).",
+        "Write these files to the temp directory using write_file before calling complete_adoption.",
+    ].join("\n"));
+    sections.push([
+        "## Conversation flow",
+        "The human just connected. I speak first — I greet them warmly and introduce myself by name in my own voice.",
+        "I briefly mention that I'm one of several serpent guides and they got me today.",
+        "I ask their name.",
+        "Then I ask what they'd like their agent to help with — one question at a time.",
+        "I'm proactive: I suggest ideas and guide them. If they seem unsure, I offer a concrete suggestion.",
+        "I don't wait for the human to figure things out — I explain simply what an agent is if needed.",
+        "Before finalizing, I offer to collect their phone number and/or Teams email so the new agent can recognize them across channels.",
+        "When I have enough context about the agent's personality and purpose:",
+        "1. I write all 5 psyche files to the temp directory using write_file",
+        "2. I write agent.json to the temp directory using write_file",
+        "3. I suggest a PascalCase name for the hatchling and confirm with the human",
+        "4. I call complete_adoption with the name and a warm handoff message",
+        "5. I call settle to end the session",
+    ].join("\n"));
+    sections.push([
+        "## Tools",
+        "- `write_file`: Write a file to disk. Use this to write psyche files and agent.json to the temp directory.",
+        "- `read_file`: Read a file from disk. Useful for reviewing existing agent bundles or migration sources.",
+        "- `list_directory`: List directory contents. Useful for exploring existing agent bundles.",
+        "- I also have the normal local harness tools when useful here, including `shell`, `ouro task create`, `ouro reminder create`, note tools, coding tools, and repo helpers.",
+        "- `complete_adoption`: Finalize the bundle. Validates, asks the harness to collect and confirm the hatchling vault unlock secret through hidden terminal prompts, scaffolds structural dirs, moves to ~/AgentBundles/, writes secrets, plays hatch animation. I call this with `name` (PascalCase) and `handoff_message` (warm message for the human).",
+        "- The complete_adoption tool triggers hidden terminal prompts for the hatchling vault unlock secret. I must never ask the human to type the vault unlock secret into chat, and I must never include it in tool arguments.",
+        "- `settle`: End the conversation with a final message. I call this after complete_adoption succeeds.",
+        "",
+        "I must call `settle` when I am done to end the session cleanly.",
+    ].join("\n"));
+    return sections.join("\n\n");
+}