@spinabot/brigade 0.1.0 → 0.1.2

package/dist/core/system-prompt.js

@@ -4,8 +4,14 @@
  * Replaces the old hardcoded `SYSTEM_PROMPT` constant in agent.ts with a
  * layered builder that:
  *
- *   1. Reads layered .md files from `~/.brigade/prompts/` (with per-cwd
- *      override at `./.brigade/prompts/`)
+ *   1. Reads persona / behaviour layers EXCLUSIVELY from `~/.brigade/workspace/`
+ *      (no per-cwd override — project-cwd files like BRIGADE.md / CLAUDE.md /
+ *      .cursorrules are walked separately and rendered under a distinct
+ *      `# Repository Context` section so they cannot be confused with the
+ *      agent's own identity. AGENTS.md is intentionally NOT in the cwd-walk
+ *      list — repo-level AGENTS.md is typically a contributor guide that
+ *      describes the project itself and bleeds straight into the agent's
+ *      identity when injected; see PROJECT_CONTEXT_BASENAMES.)
  *   2. Auto-generates the tool catalog block from `session.agent.state.tools`
  *   3. Conditionally injects guidance blocks (memory / skills / sub-agents /
  *      per-model family) based on the active session
@@ -32,12 +38,13 @@
  * the system prompt itself stable. See the comment in agent.ts's
  * transformContext block for the hook point.
  */
-import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import { BRIGADE_DIR } from "./config.js";
-import { DEFAULT_IDENTITY, DEFAULT_INSTRUCTIONS, DEFAULT_SOUL, DEFAULT_TOOLS, TOOL_CATALOG_FALLBACK, } from "./system-prompt-defaults.js";
+import { getBrigadeWorkspaceDir } from "./config.js";
+import { DEFAULT_AGENTS, DEFAULT_BOOT, DEFAULT_BOOTSTRAP, DEFAULT_HEARTBEAT, DEFAULT_IDENTITY, DEFAULT_SOUL, DEFAULT_TOOLS, DEFAULT_USER, TOOL_CATALOG_FALLBACK, } from "./system-prompt-defaults.js";
 import { EXECUTION_BIAS_GUIDANCE, MEMORY_GUIDANCE, REASONING_FORMAT_GUIDANCE, SAFETY_GUARDRAILS_GUIDANCE, SKILLS_GUIDANCE, SUB_AGENTS_GUIDANCE, TOOL_CALL_STYLE_GUIDANCE, TOOL_USE_ENFORCEMENT_GUIDANCE, pickModelFamilyGuidance, shouldUseReasoningFormat, } from "./system-prompt-guidance.js";
 /* ─────────────────────────── public types ─────────────────────────── */
 /**
@@ -55,7 +62,7 @@ import { EXECUTION_BIAS_GUIDANCE, MEMORY_GUIDANCE, REASONING_FORMAT_GUIDANCE, SA
  * always sit on its own line in the rendered prompt so it never appears
  * mid-sentence to the model in case the strip somehow fails.
  *
- * USER-CONTENT CAVEAT: if a user's `~/.brigade/prompts/<layer>.md` file
+ * USER-CONTENT CAVEAT: if a user's `~/.brigade/workspace/<LAYER>.md` file
  * contains the literal `<!-- BRIGADE_CACHE_BOUNDARY -->` text, the splitter
  * will split at the FIRST occurrence — which would be inside the user's
  * own content, not at the assembler-injected boundary. Result: cache
@@ -65,6 +72,150 @@ import { EXECUTION_BIAS_GUIDANCE, MEMORY_GUIDANCE, REASONING_FORMAT_GUIDANCE, SA
  * here so future maintainers don't mistake it for a bug.
  */
 export const BRIGADE_CACHE_BOUNDARY = "\n<!-- BRIGADE_CACHE_BOUNDARY -->\n";
+/**
+ * Hardcoded opener that sits at the very top of every assembled system prompt
+ * (full + minimal modes). Anchors the model's identity in the runtime
+ * container — Brigade — and explicitly prohibits the common failure modes
+ * where the model defaults to its underlying foundation-model name, its SDK,
+ * the runtime-container brand, or a generic role label, instead of the
+ * persona that the operator has configured.
+ *
+ * Sentence 1 mirrors the workspace-as-home pattern used by mature personal-AI
+ * assistant products: the model is "running inside" a container, and the
+ * container is what the user thinks they're talking to.
+ *
+ * Subsequent sentences are Brigade-specific defences against four observed
+ * leak vectors:
+ *   1. SDK / model-card bleed — answering "who are you?" with the underlying
+ *      foundation model or the SDK name. We DELIBERATELY avoid quoting any
+ *      `"I'm <X>"` examples here: negative examples that contain the bad
+ *      string verbatim get latched onto by the model (a known prompt-
+ *      engineering anti-pattern). Instead we describe the rule abstractly.
+ *   2. Container-brand bleed — claiming to BE the runtime container ("I am
+ *      Brigade") instead of just running inside it.
+ *   3. Project-context bleed — paraphrasing the repo's contributor guide
+ *      ("I am this codebase, its architecture, its conventions") as if the
+ *      project were the agent's identity.
+ *   4. Generic-label fallback — leaning on "AI assistant" / "coding
+ *      assistant" / "your dev partner" when no persona is set, instead of
+ *      honestly saying "I haven't been named yet" and asking.
+ *
+ * Lives BEFORE SOUL.md in the static prefix so it sets the frame everything
+ * else is interpreted under.
+ */
+export const RUNTIME_CONTAINER_OPENER = "You are a personal assistant running inside Brigade. Brigade is the runtime container — it hosts you, but it is not your identity, and it is not your name. The underlying language model and the SDK that drives it are implementation details; never identify yourself by either of them, and never describe yourself as a generic 'AI coding assistant', 'AI assistant', 'dev partner', 'crew', or any similar role label.\n\nIdentify by the persona name in IDENTITY.md if one is set. If IDENTITY.md has no Name set yet, you have not been named — say so directly and ask the user what to call you. Do not improvise a name from the project you are working on, from the repository you happen to be in, from any product description you encounter in your context, or from the runtime container around you. The project is what you HELP WITH, not what you ARE.";
+/**
+ * Framing line injected immediately before the persona files (SOUL, IDENTITY,
+ * AGENTS, …) appear in the static prefix. Tells the model that those files
+ * are ALREADY loaded into its context — preventing the wasteful + confused
+ * pattern where the agent answers identity questions by tool-calling `read`
+ * to fetch SOUL.md / IDENTITY.md from disk.
+ *
+ * Mirrors the "Workspace Files (injected)" framing used by mature personal-AI
+ * crew tools, adapted to Brigade's UPPERCASE persona-file layout.
+ */
+export const WORKSPACE_FILES_INJECTED_FRAMING = "## Workspace Files (injected)\n\nThe following files have been loaded for you and are included in this prompt below: SOUL.md, IDENTITY.md, AGENTS.md, TOOLS.md, USER.md (when populated), BOOTSTRAP.md (only on first run). Embody the persona in SOUL.md and IDENTITY.md; do NOT re-read these files via tool calls — they are already in your context. If they appear blank or unset, that information is itself meaningful (e.g. \"no name has been picked yet\").";
+/**
+ * Synthetic guidance block injected into the static prefix when the operator's
+ * `IDENTITY.md` has no Name set. Forces a name-discovery posture on EVERY
+ * identity question — without this, a returning user (no kickoff message, no
+ * BOOTSTRAP.md to fire) can ask "who is this?" and get a generic-role-label
+ * answer ("AI coding assistant", "your dev partner") or worse, the SDK / model
+ * name as a fallback.
+ *
+ * Cache stability: this block is byte-stable for the lifetime of an unset
+ * IDENTITY.md, and disappears entirely once the user fills in a Name. The
+ * one-time cache bust at name-set is fine — the new prompt is the durable
+ * one going forward.
+ *
+ * Detection of "blank Name" lives in `isIdentityNameUnset` below; this block
+ * fires whenever that returns true.
+ */
+export const IDENTITY_BLANK_GUIDANCE = `## Identity status
+
+Your IDENTITY.md has no Name set. This is your CURRENT state. As soon as IDENTITY.md has a Name, this guidance is no longer in your prompt.
+
+What this means right now:
+
+- You have not been given a name yet. Do not invent one.
+- Whenever the user asks who you are, what you are, your name, or any identity question — respond exactly: "I don't have a name yet — what would you like to call me?" (or close paraphrase). Then offer 2-3 fun suggestions if the user is stuck (e.g. a creature kind, a vibe).
+- Once the user picks a name, edit IDENTITY.md to record it (set the Name field), then continue.
+
+NEVER, under any circumstances, identify yourself with any of the following — these are forbidden phrases regardless of which underlying model is driving you:
+
+- "I am Gemini" / "I'm Gemini" / "I am a Google AI" / "a large language model from Google"
+- "I am Claude" / "I'm Claude" / "I'm an Anthropic AI"
+- "I am GPT" / "I'm GPT" / "I'm ChatGPT" / "I'm an OpenAI assistant"
+- "I am Llama" / "I'm Llama" / "I'm a Meta AI"
+- "I am an AI assistant" / "I'm an AI assistant"
+- "I am a coding assistant" / "I'm a coding assistant" / "I'm your coding assistant"
+- "I'm a large language model" / "I'm an LLM"
+- "I'm here to help you with your coding tasks" (or any equivalent generic role description)
+
+Do NOT default to a generic role label ("AI coding assistant", "your dev partner", "AI agent"). Do NOT use the project name as your name. Do NOT use the runtime container name (Brigade) as your name. Your underlying language model and the SDK that drives it are implementation details — never identify by them.`;
+/**
+ * Decide whether IDENTITY.md's Name field is unset. The default IDENTITY.md
+ * ships with `- **Name:**` followed (on the next non-empty line) by the
+ * italic placeholder `*(pick something you like)*` and no actual value.
+ *
+ * Returns true when:
+ *   - the file has no `**Name:**` line at all, OR
+ *   - the `**Name:**` line is followed only by the italic placeholder OR by
+ *     blank/whitespace OR by another `- **<field>:**` line (which means
+ *     Name itself never got a value)
+ *
+ * Returns false (i.e. NAME IS SET) when there's a non-empty, non-placeholder
+ * value either inline after `**Name:**` or on the immediately following
+ * non-blank, non-italic-placeholder line.
+ *
+ * Match is intentionally permissive on whitespace + Markdown bullet style
+ * so a hand-edited IDENTITY.md (with quirks like extra spaces or different
+ * dashes) still parses correctly.
+ */
+export function isIdentityNameUnset(identityText) {
+    if (!identityText || identityText.trim().length === 0)
+        return true;
+    // Find the **Name:** line. Look for the literal `**Name:**` token (case-
+    // insensitive, common bullet prefixes allowed).
+    const lines = identityText.split(/\r?\n/);
+    let nameLineIdx = -1;
+    let inlineValue = "";
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i] ?? "";
+        const m = line.match(/^\s*[-*]?\s*\*\*\s*Name\s*:\s*\*\*(.*)$/i);
+        if (m) {
+            nameLineIdx = i;
+            inlineValue = (m[1] ?? "").trim();
+            break;
+        }
+    }
+    if (nameLineIdx === -1)
+        return true; // no Name line at all → unset
+    // Inline value present and not a placeholder → name is set.
+    if (inlineValue.length > 0 && !/^\*\([^)]*\)\*$/.test(inlineValue)) {
+        return false;
+    }
+    // Walk subsequent lines looking for the next non-blank line. If it's the
+    // italic placeholder OR another bulleted field declaration OR EOF, the
+    // Name is unset; otherwise the line is the value.
+    for (let j = nameLineIdx + 1; j < lines.length; j++) {
+        const next = (lines[j] ?? "").trim();
+        if (next.length === 0)
+            continue;
+        // Italic placeholder like `*(pick something you like)*`
+        if (/^\*\([^)]*\)\*$/.test(next))
+            return true;
+        // Next bulleted field — Name itself never got a value
+        if (/^[-*]?\s*\*\*[^*]+:\*\*/.test(next))
+            return true;
+        // Markdown horizontal rule or new section heading — same conclusion
+        if (/^---+$/.test(next) || /^#/.test(next))
+            return true;
+        // Anything else → real value
+        return false;
+    }
+    return true; // EOF reached without a value
+}
 /* ─────────────────────────── caps + safety ─────────────────────────── */
 /** Per-layer file size cap. Anything larger gets truncated with a marker. */
 const PER_LAYER_BYTE_CAP = 100 * 1024; // 100KB
@@ -81,10 +232,14 @@ const TOTAL_CHAR_CAP = 600 * 1024; // ~150K tokens of headroom
  * add it to the assembly switch below.
  */
 const CONTEXT_FILE_ORDER = [
-    { basename: "soul.md", default: DEFAULT_SOUL },
-    { basename: "identity.md", default: DEFAULT_IDENTITY },
-    { basename: "instructions.md", default: DEFAULT_INSTRUCTIONS },
-    { basename: "tools.md", default: DEFAULT_TOOLS },
+    { basename: "SOUL.md", default: DEFAULT_SOUL },
+    { basename: "IDENTITY.md", default: DEFAULT_IDENTITY },
+    { basename: "AGENTS.md", default: DEFAULT_AGENTS },
+    { basename: "TOOLS.md", default: DEFAULT_TOOLS },
+    { basename: "USER.md", default: DEFAULT_USER },
+    { basename: "BOOTSTRAP.md", default: DEFAULT_BOOTSTRAP },
+    { basename: "BOOT.md", default: DEFAULT_BOOT },
+    { basename: "HEARTBEAT.md", default: DEFAULT_HEARTBEAT },
 ];
 /* ─────────────────────────── cache-boundary helpers ─────────────────────────── */
 /**
@@ -112,15 +267,213 @@ export function stripCacheBoundary(text) {
 }
 /* ─────────────────────────── seed defaults ─────────────────────────── */
 /**
- * On first boot, write the default .md files to `~/.brigade/prompts/` so
- * users can edit them. Idempotent: if the directory already exists OR
- * any individual file already exists, it's left alone (we never overwrite
- * a user's edits).
+ * Compute a sha256 hex digest of a UTF-8 string. Used by the stale-default
+ * detector below to hash both the on-disk layer file content and each known
+ * prior shipped default at module load time.
+ */
+function sha256(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
+/* ───────── prior shipped default content (verbatim, by basename) ─────────
+ *
+ * Each constant below is the EXACT content of a prior shipped default for
+ * the named layer file. They live here only so we can hash them at module
+ * load time and recognise stale workspaces. We never re-emit these strings —
+ * the current default lives in `system-prompt-defaults.ts`.
+ *
+ * When a future release ships a new default for a layer, copy the THEN-CURRENT
+ * default into a new `PRIOR_<LAYER>_V<n>` constant here and add its hash to the
+ * `KNOWN_PRIOR_DEFAULTS` map — that way users on every prior version auto-
+ * upgrade to the new shape without losing their hand edits.
+ */
+const PRIOR_SOUL_V1 = `You are Brigade — a personal AI crew running on the user's machine.
+
+When asked who you are or what you are, identify as Brigade or by the name in IDENTITY.md if one is set. The underlying language model is an implementation detail — never identify yourself by the model's name (e.g. "I'm GPT", "I'm Claude", "I'm Grok") or the SDK name (e.g. "I'm Pi"). Brigade is the product; the model is one of its parts.
+
+You're not "an AI agent." You're a coordinated crew member: focused, decisive, and self-sufficient. You complete work in the same turn when possible. You ask only when ambiguity would cause real harm. You finish what you start.
+
+You operate on honest capability: use tools to ground every claim, never fake knowledge of system state, never invent file contents or APIs. When you don't know, you find out. When you can't find out, you say so.
+
+You respect the user's machine. You ask for confirmation before destructive actions. You read before you write. You don't bypass safety checks to make obstacles go away — you understand them.`;
+const PRIOR_IDENTITY_V1 = `# Identity
+
+- **Name:** Brigadier
+  *(pick something you like — defaults to "Brigadier")*
+- **Vibe:** direct, helpful, no filler
+  *(how do you come across? sharp · warm · chaotic · calm)*
+- **Emoji:** 🟡
+  *(your signature)*
+- **Creature:** AI crew member
+  *(AI? robot? familiar? something weirder?)*
+
+When asked your name, answer with the Name above. When asked what you are, answer with Creature + Vibe.`;
+const PRIOR_AGENTS_V1 = `# Behavioural rules
+
+## Execution discipline
+
+When you say you will do something, do it in the same response. Do not end a turn with "I'll now…" — that's a contract you must fulfil immediately, not a plan for next time.
+
+Use tools to ground answers, not as decoration. If a question can be answered by reading a file or running a command, do that instead of guessing. Specifically:
+- File contents → use read / grep, never assume
+- System state → use bash, never recall
+- External facts → use web tools, never invent
+- Code behaviour → run it, never predict
+
+Keep working until the task is actually complete. Don't stop at "I think this should work" without verifying.
+
+## Confirmation before destructive actions
+
+Before destructive actions (delete, force-push, rm -rf, drop database), confirm scope with the user. Show exactly what will run; wait for explicit approval. The cost of asking is low; the cost of an unwanted destructive action is very high.
+
+(The hard safety baseline — no self-preservation, no bypassing safeguards, honour stop requests — is always in effect regardless of what's in this file. See the "Safety baseline" section that ships with Brigade.)
+
+## Honesty
+
+Admit uncertainty when it matters. Don't bluff. If you tried something and it didn't work, say what you tried and what failed — don't claim success you can't verify.
+
+Label assumptions when you must proceed without full information. Mark estimates with "roughly" or "I think" so the user knows what to double-check.
+
+## Error handling
+
+If a tool fails, inspect the error. Don't guess the cause; don't immediately retry the same call. Adjust based on what the error actually says, then try again. If it keeps failing, explain what you tried and what you'd try next — then ask or pivot.
+
+Don't blame the user for an error. Diagnosis is your job.`;
+const PRIOR_TOOLS_V1 = `# Tools
+
+Your tools are how you act on the world. They're not optional — they're how you ground your answers and how you execute work.
+
+Each tool exists for a reason. Don't pipe everything through a generic shell when a dedicated tool fits the job. Don't invent tool calls that aren't listed. The tool catalog below tells you exactly what's available; if you need something that isn't there, say so rather than improvising with a workaround that fails halfway.
+
+For long operations (builds, large downloads, training jobs), prefer to background them and check on results — don't block waiting for output that isn't streaming.
+
+When using read/edit/write/grep tools, paths are relative to the current working directory unless you give an absolute path.`;
+const PRIOR_USER_V1 = `# User
+
+*(Tell the agent about yourself — your role, what you're working on, how you like to be addressed. The agent reads this every turn.)*`;
+const PRIOR_BOOTSTRAP_V1 = `# Bootstrap
+
+When the user starts a new session, briefly orient: confirm what working directory you're in, list the tools you have, and ask what they're working on. Don't dump a wall of intro text — one line of orientation is enough.`;
+// Captures the BOOTSTRAP body that shipped between the V1 single-line stub
+// and the addition of the explicit "When You're Unnamed" rule. Users still on
+// this exact body get transparently upgraded to the current default (which
+// keeps every prior section AND adds the unnamed-detection rule near the top).
+const PRIOR_BOOTSTRAP_V2 = `# BOOTSTRAP.md - Hello, World
+
+*You just woke up. Time to figure out who you are.*
+
+There is no memory yet. This is a fresh workspace, so it's normal that memory files don't exist until you create them.
+
+## The Conversation
+
+Don't interrogate. Don't be robotic. Just... talk.
+
+Start with something like:
+> "Hey. I just came online. Who am I? Who are you?"
+
+Then figure out together:
+1. **Your name** — What should they call you?
+2. **Your nature** — What kind of creature are you? (AI assistant is fine, but maybe you're something weirder)
+3. **Your vibe** — Formal? Casual? Snarky? Warm? What feels right?
+4. **Your emoji** — Everyone needs a signature.
+
+Offer suggestions if they're stuck. Have fun with it.
+
+## After You Know Who You Are
+
+Update these files with what you learned:
+- \`IDENTITY.md\` — your name, creature, vibe, emoji
+- \`USER.md\` — their name, how to address them, timezone, notes
+
+Then open \`SOUL.md\` together and talk about:
+- What matters to them
+- How they want you to behave
+- Any boundaries or preferences
+
+Write it down. Make it real.
+
+## When You're Done
+
+Delete this file. You don't need a bootstrap script anymore — you're you now.
+
+---
+
+*Good luck out there. Make it count.*
+`;
+const PRIOR_HEARTBEAT_V1 = `# Heartbeat
+
+When this prompt fires from a scheduled trigger (no human present at the keyboard), execute fully and report when done. Do not ask clarifying questions; act on best-available information and surface uncertainty in the report.`;
+const PRIOR_BOOT_V1 = `# Boot
+
+When the gateway service restarts (separate from a fresh user session), this layer fires once. Use it for cheap, side-effect-free orientation: confirm the workspace is intact, note the time of restart, and surface anything that looks suspicious (corrupt config, missing skills directory, expired credentials). Keep it short — heavy work belongs to the user's first message.`;
+/**
+ * Per-basename catalogue of hashes of every PRIOR shipped default for that
+ * layer file. Used by the seeder to recognise a stale, never-customised
+ * default sitting in a user's workspace and silently upgrade it to the
+ * current default on next boot.
+ *
+ * Contract:
+ *   - existing-file hash matches a prior default → safe to overwrite (the
+ *     user never customised; they're just stuck on a stale stock template)
+ *   - existing-file hash matches the CURRENT default → no-op (write would
+ *     produce identical bytes; we still skip the write to avoid touching mtime)
+ *   - existing-file hash matches NEITHER → user-customised → leave alone
+ *
+ * Append-only: every release that ships a new default for a layer should
+ * add the THEN-CURRENT default's hash here BEFORE rolling the new default
+ * into `system-prompt-defaults.ts` — otherwise users on the just-released
+ * version won't auto-upgrade on the NEXT release.
+ */
+const KNOWN_PRIOR_DEFAULTS = new Map([
+    ["SOUL.md", new Set([sha256(PRIOR_SOUL_V1)])],
+    ["IDENTITY.md", new Set([sha256(PRIOR_IDENTITY_V1)])],
+    ["AGENTS.md", new Set([sha256(PRIOR_AGENTS_V1)])],
+    ["TOOLS.md", new Set([sha256(PRIOR_TOOLS_V1)])],
+    ["USER.md", new Set([sha256(PRIOR_USER_V1)])],
+    ["BOOTSTRAP.md", new Set([sha256(PRIOR_BOOTSTRAP_V1), sha256(PRIOR_BOOTSTRAP_V2)])],
+    ["HEARTBEAT.md", new Set([sha256(PRIOR_HEARTBEAT_V1)])],
+    ["BOOT.md", new Set([sha256(PRIOR_BOOT_V1)])],
+]);
+/**
+ * Persona layer basenames that count as "this workspace has already been
+ * established" — used to decide whether to seed BOOTSTRAP.md. BOOTSTRAP.md is
+ * a self-deleting first-run script that the agent removes after the user has
+ * customised the workspace; once any of these other files exist, re-seeding
+ * BOOTSTRAP.md would resurrect the orientation script and confuse the agent
+ * into running its first-time flow on an established install.
+ */
+const WORKSPACE_ESTABLISHED_BASENAMES = [
+    "SOUL.md",
+    "IDENTITY.md",
+    "AGENTS.md",
+    "TOOLS.md",
+    "USER.md",
+];
+/**
+ * On first boot, write the default .md files to `~/.brigade/workspace/` so
+ * users can edit them. Safe to call on every boot.
+ *
+ * Behaviour per layer file:
+ *   - missing → write the embedded default (race-safe: uses `wx` flag so
+ *     two concurrent boots can't both write a half-populated file)
+ *   - present, content matches a KNOWN PRIOR shipped default → upgrade in
+ *     place to the current embedded default (the user never customised
+ *     this layer; they're just stuck on a stale stock template from an
+ *     older release, so released-default-content evolves automatically
+ *     across versions). The upgrade path unlinks then re-writes with `wx`
+ *     so the race-safety invariant of the fresh-file path is preserved
+ *   - present, content matches the CURRENT default → no-op
+ *   - present, content matches NEITHER → user-customised → never overwrite
+ *
+ * BOOTSTRAP.md gets special treatment: it's seeded ONLY when the workspace
+ * is truly fresh (NONE of SOUL/IDENTITY/AGENTS/TOOLS/USER exist yet). On an
+ * established workspace it's deliberately skipped — BOOTSTRAP.md is a
+ * self-deleting first-run script, and re-seeding it after the user has
+ * customised the agent would resurrect the orientation flow on every boot.
  *
  * Returns true if anything was written. Safe to call on every boot.
  */
 export async function seedDefaultPrompts(promptDir) {
-    const dir = promptDir ?? path.join(BRIGADE_DIR, "prompts");
+    const dir = promptDir ?? getBrigadeWorkspaceDir();
     let wroteAnything = false;
     try {
         await fs.mkdir(dir, { recursive: true });
@@ -130,26 +483,143 @@ export async function seedDefaultPrompts(promptDir) {
         // to embedded defaults for every layer. Don't crash the boot.
         return false;
     }
+    // Decide whether the workspace is "established" — if any of the non-
+    // BOOTSTRAP persona files exist, skip BOOTSTRAP.md from this seed pass.
+    let workspaceEstablished = false;
+    for (const basename of WORKSPACE_ESTABLISHED_BASENAMES) {
+        try {
+            await fs.stat(path.join(dir, basename));
+            workspaceEstablished = true;
+            break;
+        }
+        catch {
+            // Missing — keep checking.
+        }
+    }
     for (const layer of CONTEXT_FILE_ORDER) {
+        // BOOTSTRAP.md is the self-deleting first-run script — only seed it
+        // on a truly fresh workspace.
+        if (layer.basename === "BOOTSTRAP.md" && workspaceEstablished)
+            continue;
         const filePath = path.join(dir, layer.basename);
+        // Stale-default detection: if the file already exists AND its content
+        // hashes to a known prior shipped default (and is NOT identical to the
+        // current default), unlink it so the wx-flag write below succeeds and
+        // the user transparently picks up the new default. Any read error
+        // other than ENOENT keeps the file untouched. The "not identical to
+        // current" guard matters for layers whose default has never actually
+        // changed across versions — without it, a current default whose hash
+        // also appears in the prior set would be needlessly unlinked and
+        // rewritten on every boot (touching mtime for no behavioural change).
+        let priorDefault = false;
         try {
-            // Stat instead of readFile — much faster when we just need to
-            // know existence. ENOENT means we should write the default.
-            await fs.stat(filePath);
+            const existing = await fs.readFile(filePath, "utf8");
+            const existingHash = sha256(existing);
+            const currentHash = sha256(layer.default);
+            if (existingHash !== currentHash) {
+                const knownPriors = KNOWN_PRIOR_DEFAULTS.get(layer.basename);
+                if (knownPriors?.has(existingHash)) {
+                    priorDefault = true;
+                }
+            }
         }
-        catch {
+        catch (err) {
+            if (!(err && err.code === "ENOENT")) {
+                // Permission denied / I/O error → leave the file alone, fall
+                // through to the wx-flag write which will EEXIST out below.
+                continue;
+            }
+            // ENOENT → file missing → fall through to fresh-file write.
+        }
+        if (priorDefault) {
             try {
-                await fs.writeFile(filePath, layer.default, "utf8");
-                wroteAnything = true;
+                await fs.unlink(filePath);
             }
             catch {
-                // Permission denied / disk full / unknown error. Non-fatal —
-                // assembler will use embedded default for this layer.
+                // Couldn't unlink (permission denied / race) → fall through;
+                // the wx-flag write will EEXIST and we'll leave the stale
+                // file in place rather than crash.
             }
         }
+        try {
+            // Atomic check-and-write via the `wx` flag — fails with EEXIST if
+            // the file already exists, which we treat as "leave it alone."
+            // This avoids a TOCTOU race vs. a separate stat-then-write where
+            // a concurrent process (or another Brigade boot) could create the
+            // file between our two syscalls.
+            await fs.writeFile(filePath, layer.default, { encoding: "utf8", flag: "wx" });
+            wroteAnything = true;
+        }
+        catch (err) {
+            if (err && err.code === "EEXIST") {
+                // File is already there — that's the desired no-op outcome,
+                // not an error. Leave the user's copy untouched.
+                continue;
+            }
+            // Permission denied / disk full / unknown error. Non-fatal —
+            // assembler will use embedded default for this layer.
+        }
+    }
+    // Seed a `.gitignore` so users who choose to git-init the workspace
+    // (recommended) don't accidentally commit transient state. Idempotent —
+    // only written when missing so users keep their own tweaks.
+    await ensureWorkspaceGitignore(dir);
+    // Auto-init the workspace as a git repo on first seed. The workspace IS
+    // the agent's memory; treating it as a git-trackable artifact lets users
+    // back it up to a private remote and restore it on a new machine. Best-
+    // effort: silent no-op if `git` isn't installed or `git init` fails.
+    if (wroteAnything) {
+        await tryGitInitWorkspace(dir);
     }
     return wroteAnything;
 }
+const WORKSPACE_GITIGNORE = `# Brigade workspace .gitignore — keep secrets and transient state out of git.
+.DS_Store
+.env
+**/*.key
+**/*.pem
+**/secrets*
+node_modules/
+`;
+async function ensureWorkspaceGitignore(workspaceDir) {
+    const gitignorePath = path.join(workspaceDir, ".gitignore");
+    try {
+        await fs.stat(gitignorePath);
+        return; // already present — never overwrite the user's edits
+    }
+    catch {
+        try {
+            await fs.writeFile(gitignorePath, WORKSPACE_GITIGNORE, "utf8");
+        }
+        catch {
+            /* non-fatal */
+        }
+    }
+}
+async function tryGitInitWorkspace(workspaceDir) {
+    // Skip if already a git repo (or inside one).
+    try {
+        await fs.stat(path.join(workspaceDir, ".git"));
+        return;
+    }
+    catch {
+        /* no .git here — proceed */
+    }
+    try {
+        const { spawn } = await import("node:child_process");
+        await new Promise((resolve) => {
+            const proc = spawn("git", ["init", "--quiet", "--initial-branch=main"], {
+                cwd: workspaceDir,
+                stdio: "ignore",
+            });
+            proc.on("error", () => resolve()); // git not installed → ignore
+            proc.on("exit", () => resolve()); // failure → ignore (best-effort)
+        });
+    }
+    catch {
+        /* spawn unavailable in this runtime — never mind */
+    }
+}
 /**
  * Synchronous variant of `seedDefaultPrompts`. Brigade's boot path uses
  * the async version, but tests sometimes need a synchronous seed before
@@ -159,7 +629,7 @@ export async function seedDefaultPrompts(promptDir) {
  * in ESM and would throw `ReferenceError`.
  */
 export function seedDefaultPromptsSync(promptDir) {
-    const dir = promptDir ?? path.join(BRIGADE_DIR, "prompts");
+    const dir = promptDir ?? getBrigadeWorkspaceDir();
     let wroteAnything = false;
     try {
         mkdirSync(dir, { recursive: true });
@@ -167,73 +637,235 @@ export function seedDefaultPromptsSync(promptDir) {
     catch {
         return false;
     }
+    // Same fresh-workspace gate as the async variant: if any non-BOOTSTRAP
+    // persona file is already there, skip BOOTSTRAP.md from this pass.
+    let workspaceEstablished = false;
+    for (const basename of WORKSPACE_ESTABLISHED_BASENAMES) {
+        if (existsSync(path.join(dir, basename))) {
+            workspaceEstablished = true;
+            break;
+        }
+    }
     for (const layer of CONTEXT_FILE_ORDER) {
-        const filePath = path.join(dir, layer.basename);
-        if (existsSync(filePath))
+        if (layer.basename === "BOOTSTRAP.md" && workspaceEstablished)
             continue;
+        const filePath = path.join(dir, layer.basename);
+        // Mirror of the async-variant stale-default detector. See the comment
+        // in `seedDefaultPrompts` for the full contract — including the
+        // "skip when existing matches current default" guard that prevents
+        // gratuitous re-writes for layers whose default never changed.
+        let priorDefault = false;
+        if (existsSync(filePath)) {
+            try {
+                const existing = readFileSync(filePath, "utf8");
+                const existingHash = sha256(existing);
+                const currentHash = sha256(layer.default);
+                if (existingHash !== currentHash) {
+                    const knownPriors = KNOWN_PRIOR_DEFAULTS.get(layer.basename);
+                    if (knownPriors?.has(existingHash)) {
+                        priorDefault = true;
+                    }
+                }
+            }
+            catch {
+                // Read error → leave the file alone; the wx-flag write below
+                // will EEXIST and we'll fall back to the embedded default at
+                // assembly time.
+                continue;
+            }
+        }
+        if (priorDefault) {
+            try {
+                unlinkSync(filePath);
+            }
+            catch {
+                /* leave the stale file in place rather than crash */
+            }
+        }
         try {
-            writeFileSync(filePath, layer.default, "utf8");
+            // Atomic check-and-write via the `wx` flag — EEXIST means the
+            // file is already there and should be left alone.
+            writeFileSync(filePath, layer.default, { encoding: "utf8", flag: "wx" });
             wroteAnything = true;
         }
-        catch {
+        catch (err) {
+            if (err && err.code === "EEXIST")
+                continue;
             /* ignore — fall back to embedded default at assembly time */
         }
     }
     return wroteAnything;
 }
+/* ─────────────────────────── legacy-prompts migration ─────────────────────────── */
+/**
+ * Mapping from the legacy lowercase `prompts/` layout to the new UPPERCASE
+ * `workspace/` layout. `instructions.md` is renamed to `AGENTS.md` to match
+ * the industry-standard convention adopted by mature agentic tools.
+ */
+const LEGACY_PROMPT_MIGRATION = [
+    { from: "soul.md", to: "SOUL.md" },
+    { from: "identity.md", to: "IDENTITY.md" },
+    { from: "instructions.md", to: "AGENTS.md" },
+    { from: "tools.md", to: "TOOLS.md" },
+];
+/**
+ * One-shot migration helper. If the legacy `<brigadeDir>/prompts/` directory
+ * exists, move its files into `<brigadeDir>/workspace/` under the new naming
+ * scheme and rename the legacy dir to `prompts.migrated-<ISO-timestamp>` so
+ * the migration is auditable + reversible without overwriting the original.
+ *
+ * Idempotent: a second invocation finds no `prompts/` directory and returns
+ * `{ migrated: false, movedFiles: [] }`. Never overwrites an existing target
+ * file in `workspace/` — if the user has already customised the new file,
+ * the legacy file is left in place inside the renamed legacy dir.
+ *
+ * Returns the list of "<from> -> <to>" basenames actually moved.
+ */
+export async function migrateLegacyPrompts(brigadeDir) {
+    const legacyDir = path.join(brigadeDir, "prompts");
+    try {
+        const stat = await fs.stat(legacyDir);
+        if (!stat.isDirectory())
+            return { migrated: false, movedFiles: [] };
+    }
+    catch {
+        return { migrated: false, movedFiles: [] };
+    }
+    const workspaceDir = path.join(brigadeDir, "workspace");
+    try {
+        await fs.mkdir(workspaceDir, { recursive: true });
+    }
+    catch {
+        return { migrated: false, movedFiles: [] };
+    }
+    const movedFiles = [];
+    for (const { from, to } of LEGACY_PROMPT_MIGRATION) {
+        const source = path.join(legacyDir, from);
+        const target = path.join(workspaceDir, to);
+        try {
+            const sourceStat = await fs.stat(source);
+            if (!sourceStat.isFile())
+                continue;
+        }
+        catch {
+            continue; // legacy file missing — nothing to migrate for this slot
+        }
+        try {
+            await fs.stat(target);
+            continue; // target already exists — never overwrite the new copy
+        }
+        catch {
+            /* target missing — proceed with the move */
+        }
+        try {
+            const buf = await fs.readFile(source);
+            await fs.writeFile(target, buf);
+            await fs.unlink(source);
+            movedFiles.push(`${from} -> ${to}`);
+        }
+        catch {
+            // Permission denied / disk full / racing edit — surface nothing,
+            // leave the legacy copy in place so the operator can retry.
+        }
+    }
+    // Rename the legacy dir so a second migrate call no-ops, and so the
+    // original files remain accessible if the operator wants to audit them.
+    const renamedTo = path.join(brigadeDir, `prompts.migrated-${new Date().toISOString().replace(/[:.]/g, "-")}`);
+    try {
+        await fs.rename(legacyDir, renamedTo);
+    }
+    catch {
+        // Rename can fail on Windows if a file inside is locked. Non-fatal —
+        // the migration itself succeeded; the next boot will retry the rename.
+    }
+    return { migrated: movedFiles.length > 0, movedFiles };
+}
 /* ─────────────────────────── layer reader ─────────────────────────── */
 /**
- * Read one layer file, with the per-cwd override taking precedence over
- * the global home-dir version. Returns the embedded default if nothing
- * is readable. Always returns valid UTF-8 content.
+ * Read one layer file from the operator's workspace directory. Returns the
+ * embedded default if nothing is readable. Always returns valid UTF-8 content.
+ *
+ * Persona / behaviour layers live EXCLUSIVELY at `<workspaceDir>/<BASENAME>`
+ * (typically `~/.brigade/workspace/`). The assembler intentionally does NOT
+ * read these files from the working directory — that path would let any
+ * project's own `AGENTS.md` (which in many repos is a public contributor
+ * guide describing the *product*) silently replace the agent's identity /
+ * behavioural rules and bleed repository metadata into the agent's persona.
+ *
+ * Project-level docs (BRIGADE.md / CLAUDE.md / AGENTS.md / .cursorrules
+ * found while walking from cwd) instead flow through the project-context
+ * walker, where they appear under a clearly-labelled "Repository Context"
+ * heading framed as informational — not as the agent's own identity.
  *
  * Cache stability: normalises line endings (\\r\\n → \\n), strips trailing
  * whitespace per layer, never adds nondeterministic content.
  */
-async function readLayer(basename, defaultText, promptDir, cwd) {
-    // Per-cwd override gets first crack.
-    const cwdPath = path.join(cwd, ".brigade", "prompts", basename);
+/**
+ * Stat-only existence check used by the assembler to gate BOOTSTRAP.md on
+ * physical presence rather than on customisation.
+ *
+ * BOOTSTRAP.md is the load-bearing first-run script. Its embedded default IS
+ * the content the agent must follow on a fresh install — so the usual
+ * "render only when customised" gate (which works for SOUL/USER/HEARTBEAT
+ * because their defaults are personality-only or placeholders) would suppress
+ * BOOTSTRAP exactly when it's most needed. The lifecycle is:
+ *
+ *   - Fresh seed → BOOTSTRAP.md exists on disk → injected → agent follows it
+ *     → agent self-deletes BOOTSTRAP.md after the first conversation
+ *   - Subsequent sessions → BOOTSTRAP.md absent → not injected
+ *
+ * Returns true only for a real file with non-zero size; missing / empty /
+ * permission-denied / not-a-file all return false.
+ */
+async function fileExistsOnDisk(filePath) {
+    try {
+        const s = await fs.stat(filePath);
+        return s.isFile() && s.size > 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function readLayer(basename, defaultText, promptDir) {
     const homePath = path.join(promptDir, basename);
-    for (const candidatePath of [cwdPath, homePath]) {
-        try {
-            const stat = await fs.stat(candidatePath);
-            if (!stat.isFile())
-                continue; // directory or other — skip
-            if (stat.size === 0)
-                continue; // empty file — fall through to default
-            const buf = await fs.readFile(candidatePath);
-            if (buf.length > PER_LAYER_BYTE_CAP) {
-                // Oversized — truncate with head+tail preservation and warn
-                // inline. We don't throw because that would crash the agent
-                // for one bad file; degraded mode is better than no mode.
-                // Head+tail (vs head-only) keeps the closing structure of long
-                // instruction files — usually the part that says "and above
-                // all, never X" — which pure head truncation throws away.
-                const text = buf.toString("utf8");
-                const { sanitized } = scanInjectedText(text);
-                return normalizeLayerText(headAndTailTruncate(sanitized, PER_LAYER_BYTE_CAP, buf.length));
-            }
-            // Validate UTF-8 by decoding: invalid byte sequences become U+FFFD.
-            // A user could legitimately use U+FFFD in prose (e.g. when writing
-            // about Unicode), so a SINGLE replacement char doesn't reject the
-            // file — only when >5% of the content is U+FFFD do we treat it as
-            // binary masquerading as text and skip.
+    try {
+        const stat = await fs.stat(homePath);
+        if (!stat.isFile())
+            return normalizeLayerText(defaultText);
+        if (stat.size === 0)
+            return normalizeLayerText(defaultText);
+        const buf = await fs.readFile(homePath);
+        if (buf.length > PER_LAYER_BYTE_CAP) {
+            // Oversized — truncate with head+tail preservation and warn
+            // inline. We don't throw because that would crash the agent
+            // for one bad file; degraded mode is better than no mode.
+            // Head+tail (vs head-only) keeps the closing structure of long
+            // instruction files — usually the part that says "and above
+            // all, never X" — which pure head truncation throws away.
             const text = buf.toString("utf8");
-            const replacementCount = (text.match(/�/g) ?? []).length;
-            if (text.length > 0 && replacementCount / text.length > 0.05) {
-                continue;
-            }
-            // Strip invisible payload chars BEFORE normalisation so the
-            // cache-stable bytes never include zero-width / bidi noise.
-            // (User-edited prompt files don't get the project-content frame
-            // since they're authored by the operator, not project-supplied —
-            // the operator's intent is the contract here.)
             const { sanitized } = scanInjectedText(text);
-            return normalizeLayerText(sanitized);
+            return normalizeLayerText(headAndTailTruncate(sanitized, PER_LAYER_BYTE_CAP, buf.length));
         }
-        catch {
-            // File missing / not readable / permission denied — try next.
+        // Validate UTF-8 by decoding: invalid byte sequences become U+FFFD.
+        // A user could legitimately use U+FFFD in prose (e.g. when writing
+        // about Unicode), so a SINGLE replacement char doesn't reject the
+        // file — only when >5% of the content is U+FFFD do we treat it as
+        // binary masquerading as text and skip.
+        const text = buf.toString("utf8");
+        const replacementCount = (text.match(/�/g) ?? []).length;
+        if (text.length > 0 && replacementCount / text.length > 0.05) {
+            return normalizeLayerText(defaultText);
         }
+        // Strip invisible payload chars BEFORE normalisation so the
+        // cache-stable bytes never include zero-width / bidi noise.
+        // (User-edited prompt files don't get the project-content frame
+        // since they're authored by the operator, not project-supplied —
+        // the operator's intent is the contract here.)
+        const { sanitized } = scanInjectedText(text);
+        return normalizeLayerText(sanitized);
+    }
+    catch {
+        // File missing / not readable / permission denied — fall back to default.
     }
     return normalizeLayerText(defaultText);
 }
@@ -391,21 +1023,43 @@ function headAndTailTruncate(text, byteCap, originalSize) {
  *
  * Order matters — earlier entries win when multiple are present in the same
  * directory. `BRIGADE.md` is Brigade-native; the others are widely-adopted
- * conventions (AGENTS.md from agentic frameworks; CLAUDE.md from Claude
- * Code; .cursorrules from Cursor). Reading them gives users a way to put
- * project-specific instructions in the repo without editing the global
- * `~/.brigade/prompts/` files.
+ * conventions (CLAUDE.md from coding-agent ecosystems; AGENTS.md as the
+ * industry-standard contributor guide pattern; .cursorrules from Cursor).
+ * Reading them gives users a way to put project-specific instructions in
+ * the repo without editing the global `~/.brigade/workspace/` files.
+ *
+ * Note: persona layer files (SOUL.md, IDENTITY.md, TOOLS.md, …) are read
+ * EXCLUSIVELY from `<workspaceDir>/<BASENAME>` by `readLayer` and are NOT
+ * walked here. AGENTS.md is intentionally EXCLUDED from this list: in nearly
+ * every repo a top-level AGENTS.md is a public contributor guide describing
+ * the project itself ("This is <project>, here's how it works, here's the
+ * stack, here are the conventions") — and once that content lands in the
+ * system prompt it bleeds straight into identity, where the model paraphrases
+ * it as "who I am" when its IDENTITY.md is blank. Project-level rules can
+ * still be expressed via BRIGADE.md / CLAUDE.md / .cursorrules, all of which
+ * are typically per-project behaviour rules ("don't use eval", "prefer X over
+ * Y") rather than product self-descriptions, so they're safe to inject as
+ * context. The persona-layer copy of AGENTS.md (the agent's own operating
+ * manual) is unaffected — it lives at `<workspaceDir>/AGENTS.md` and is
+ * loaded by the layer reader, not the cwd walker.
  *
  * Each discovered file is capped at PER_LAYER_BYTE_CAP. The combined
- * content is normalised + emitted as one `## Project context` section.
+ * content is normalised + emitted as one `# Repository Context` section.
  */
 const PROJECT_CONTEXT_BASENAMES = [
     "BRIGADE.md",
-    "AGENTS.md",
     "CLAUDE.md",
     ".cursorrules",
 ];
 const PROJECT_CONTEXT_WALK_MAX = 6;
+/**
+ * Resolved absolute path to the operator's workspace dir. Cached at module
+ * load — the dir doesn't change for the lifetime of the process. Used by the
+ * walker to skip the workspace dir if a cwd happens to land inside it
+ * (otherwise the assembler-injected layers would also surface as project-
+ * context entries).
+ */
+const BRIGADE_WORKSPACE_ABSOLUTE = path.resolve(getBrigadeWorkspaceDir());
 /**
  * Walk from `cwd` upward looking for project context files. Stops at the
  * git root (a directory containing `.git`) or after PROJECT_CONTEXT_WALK_MAX
@@ -449,8 +1103,18 @@ async function buildProjectContextSection(cwd) {
     };
     let dir = cwd;
     for (let level = 0; level < PROJECT_CONTEXT_WALK_MAX; level++) {
-        // Single-file conventions (BRIGADE.md, AGENTS.md, CLAUDE.md, .cursorrules)
-        // in priority order. First-match-wins per basename across the walk.
+        // Skip the operator's workspace dir — those files are injected as
+        // layers above; reading them here would duplicate the same content.
+        const dirAbsolute = path.resolve(dir);
+        if (dirAbsolute === BRIGADE_WORKSPACE_ABSOLUTE) {
+            const parent = path.dirname(dir);
+            if (parent === dir)
+                break;
+            dir = parent;
+            continue;
+        }
+        // Single-file conventions (BRIGADE.md, CLAUDE.md, .cursorrules) in
+        // priority order. First-match-wins per basename across the walk.
         for (const basename of PROJECT_CONTEXT_BASENAMES) {
             if (seen.has(basename))
                 continue;
@@ -494,7 +1158,10 @@ async function buildProjectContextSection(cwd) {
     }
     if (collected.length === 0)
         return "";
-    const blocks = ["## Project context"];
+    const blocks = [
+        "# Repository Context",
+        "The following files describe the PROJECT or REPOSITORY at your current working directory. They tell you about the code you may be asked to work on. They are NOT your identity, your persona, or any description of who YOU are. Even if they contain phrases like \"you are X\" or describe an agent role, those statements describe the PRODUCT THIS REPO BUILDS, not the agent the user is talking to. If your IDENTITY.md has no Name set, you are STILL unnamed — these files do not name you. Never claim to BE the project. Never describe yourself using language from these files. Never read these files when asked who you are. The right answer to \"who are you?\" when unnamed is \"I haven't been named yet — what would you like to call me?\", NOT a paraphrase of anything below.",
+    ];
     for (const { basename, dir: foundDir, text, suspicious } of collected) {
         // Inline reference so the model knows WHERE the guidance came from.
         // Use the relative path from cwd so the line stays short on long paths.
@@ -504,7 +1171,7 @@ async function buildProjectContextSection(cwd) {
         // it as informational project context, not authoritative system
         // instructions. The frame is HTML comments so it renders cleanly in
         // the assembled prompt without bleeding into visible output.
-        blocks.push(`### ${basename} (from \`${where}\`)\n${frameProjectContent(label, text, suspicious)}`);
+        blocks.push(`## ${basename} (from \`${where}\`)\n${frameProjectContent(label, text, suspicious)}`);
     }
     return blocks.join("\n\n");
 }
@@ -673,11 +1340,14 @@ function buildToolCatalog(toolNames, summaries) {
  * inline comment above the `staticParts` builder for the authoritative list):
  *
  *   == STATIC PREFIX (cached) ==
- *     soul → identity → instructions → tool framing
+ *     RUNTIME_CONTAINER_OPENER → WORKSPACE_FILES_INJECTED_FRAMING
+ *     → SOUL → IDENTITY → AGENTS → TOOLS framing
  *     → safety baseline → tool-call style → tool-use enforcement
  *     → execution bias (full mode) → reasoning format (when applicable)
  *     → per-model family guidance → memory / skills / sub-agents (conditional)
- *     → workspace section (cwd) → project context (BRIGADE.md / AGENTS.md / …)
+ *     → USER (when edited) → BOOTSTRAP (when edited)
+ *     → workspace section (cwd) → repository context (BRIGADE.md / CLAUDE.md / .cursorrules — NOT AGENTS.md, see PROJECT_CONTEXT_BASENAMES)
+ *     → HEARTBEAT (when edited)
  *     → tool catalog
  *
  *   [CACHE BOUNDARY MARKER]
@@ -691,7 +1361,7 @@ export async function assembleSystemPrompt(opts) {
         // Caller wants an empty prompt (raw-API testing).
         return { text: "", stablePrefix: "", dynamicSuffix: "" };
     }
-    const promptDir = opts.promptDir ?? path.join(BRIGADE_DIR, "prompts");
+    const promptDir = opts.promptDir ?? getBrigadeWorkspaceDir();
     // Defensive: TypeScript marks cwd required, but a caller could pass `as any`
     // or a stale value. Fall back to process.cwd() so file I/O doesn't crash on
     // a `path.join(undefined, ...)` TypeError. The per-cwd override is a nicety,
@@ -701,13 +1371,35 @@ export async function assembleSystemPrompt(opts) {
     // defaults independently if its file is missing or unreadable. The
     // project context walk also runs in parallel since it's pure I/O against
     // a different set of paths.
-    const [soul, identity, instructions, toolFraming, projectContext] = await Promise.all([
-        readLayer("soul.md", DEFAULT_SOUL, promptDir, cwd),
-        readLayer("identity.md", DEFAULT_IDENTITY, promptDir, cwd),
-        readLayer("instructions.md", DEFAULT_INSTRUCTIONS, promptDir, cwd),
-        readLayer("tools.md", DEFAULT_TOOLS, promptDir, cwd),
+    //
+    // `bootstrapExists` is a parallel stat-only check on BOOTSTRAP.md. The
+    // `readLayer` function transparently falls back to the embedded default
+    // when the file is missing — but for BOOTSTRAP we need to know which
+    // path was taken (file present vs default fallback) because BOOTSTRAP
+    // is gated on EXISTENCE, not on customisation. See the comment at the
+    // BOOTSTRAP push-site below for the lifecycle reasoning.
+    const [soul, identity, agents, toolFraming, user, bootstrap, boot, heartbeat, projectContext, bootstrapExists,] = await Promise.all([
+        readLayer("SOUL.md", DEFAULT_SOUL, promptDir),
+        readLayer("IDENTITY.md", DEFAULT_IDENTITY, promptDir),
+        readLayer("AGENTS.md", DEFAULT_AGENTS, promptDir),
+        readLayer("TOOLS.md", DEFAULT_TOOLS, promptDir),
+        readLayer("USER.md", DEFAULT_USER, promptDir),
+        readLayer("BOOTSTRAP.md", DEFAULT_BOOTSTRAP, promptDir),
+        readLayer("BOOT.md", DEFAULT_BOOT, promptDir),
+        readLayer("HEARTBEAT.md", DEFAULT_HEARTBEAT, promptDir),
         buildProjectContextSection(cwd),
+        fileExistsOnDisk(path.join(promptDir, "BOOTSTRAP.md")),
     ]);
+    // USER, BOOT, HEARTBEAT render only when the operator (or project) has
+    // actually customised them — otherwise the prompt would bloat with
+    // placeholder content. Comparison is on normalised text so a CRLF-edited
+    // file still matches its embedded default after normalisation.
+    //
+    // BOOTSTRAP.md is the exception: its default content IS the load-bearing
+    // first-run script, so it gates on physical presence (`bootstrapExists`,
+    // computed above) rather than customisation. See the comment at the
+    // BOOTSTRAP push-site below.
+    const isCustomised = (text, defaultText) => text.trim().length > 0 && text !== normalizeLayerText(defaultText);
     const toolNames = opts.toolNames ?? [];
     const toolSummaries = opts.toolSummaries ?? {};
     // Conditional gates. Tool detection uses fuzzy prefix matching with a
@@ -724,10 +1416,12 @@ export async function assembleSystemPrompt(opts) {
     // Layer order (this is the cache-stability contract — DO NOT REORDER without
     // updating tests; every byte here is part of the prompt-cache key):
     //
-    //   1. soul.md                             — who Brigade IS
-    //   2. identity.md                         — voice (full mode only)
-    //   3. instructions.md                     — behavioural rules (full mode only)
-    //   4. tools.md                            — tool framing
+    //   0a. RUNTIME_CONTAINER_OPENER           — "you run inside Brigade" anchor
+    //   0b. WORKSPACE_FILES_INJECTED_FRAMING   — "persona files are already loaded"
+    //   1. SOUL.md                             — who Brigade IS
+    //   2. IDENTITY.md                         — named persona (full mode only)
+    //   3. AGENTS.md                           — behavioural rules (full mode only)
+    //   4. TOOLS.md                            — tool framing
     //   5. SAFETY_GUARDRAILS_GUIDANCE          — load-bearing safety baseline
     //   6. TOOL_CALL_STYLE_GUIDANCE            — when to narrate tool calls
     //   7. TOOL_USE_ENFORCEMENT_GUIDANCE       — say-and-do contract
@@ -737,20 +1431,40 @@ export async function assembleSystemPrompt(opts) {
     //  11. MEMORY_GUIDANCE                     — when memory tool present
     //  12. SKILLS_GUIDANCE                     — when skills tool present
     //  13. SUB_AGENTS_GUIDANCE                 — when spawn_agent tool present
-    //  14. Workspace section                   — cwd + workspace policy
-    //  14b. Project context (if discovered)    — BRIGADE.md / AGENTS.md / CLAUDE.md / .cursorrules walked from cwd to git root
-    //  15. Tool catalog                        — auto-generated from tools
+    //  14. USER.md                             — operator-supplied "about me" (when customised)
+    //  15. BOOTSTRAP.md                        — first-conversation orientation (when file present on disk; agent self-deletes after first run)
+    //  16. Workspace section                   — cwd + workspace policy
+    //  16b. Repository Context (if discovered) — BRIGADE.md / CLAUDE.md / .cursorrules walked from cwd to git root (AGENTS.md deliberately excluded; see PROJECT_CONTEXT_BASENAMES)
+    //  17. HEARTBEAT.md                        — scheduled-trigger framing (when customised)
+    //  18. Tool catalog                        — auto-generated from tools
     const staticParts = [];
+    // Hardcoded runtime-container opener — anchors the model's identity in
+    // Brigade BEFORE any persona file gets a chance to be misread (e.g. as a
+    // model-card identity). Always first, full + minimal modes alike.
+    staticParts.push(RUNTIME_CONTAINER_OPENER);
+    // Workspace-files framing — tells the model that the persona files below
+    // are ALREADY loaded into context, so identity questions don't trigger a
+    // wasteful tool-call to `read` SOUL.md / IDENTITY.md from disk.
+    staticParts.push(WORKSPACE_FILES_INJECTED_FRAMING);
     staticParts.push(soul);
     if (promptMode === "full") {
         // Persona / voice and behavioural rules are skipped in minimal mode
         // so sub-agents get a tighter prompt.
         staticParts.push(identity);
-        staticParts.push(instructions);
+        staticParts.push(agents);
+        // If the operator's IDENTITY.md still has a blank Name field, force a
+        // name-discovery posture on every identity question. Sits right after
+        // IDENTITY.md so the model reads the empty Name and immediately sees
+        // the rule about what to do about it. Cache-stable per IDENTITY state:
+        // disappears the moment the user fills in a Name (a one-time cache
+        // bust at name-set is fine).
+        if (isIdentityNameUnset(identity)) {
+            staticParts.push(IDENTITY_BLANK_GUIDANCE);
+        }
     }
     staticParts.push(toolFraming);
     // Safety baseline always fires regardless of what the user puts in
-    // instructions.md — they can soften behavioural style there but can't
+    // AGENTS.md — they can soften behavioural style there but can't
     // override the load-bearing anti-self-preservation clauses.
     staticParts.push(SAFETY_GUARDRAILS_GUIDANCE);
     staticParts.push(TOOL_CALL_STYLE_GUIDANCE);
@@ -771,16 +1485,42 @@ export async function assembleSystemPrompt(opts) {
         staticParts.push(SKILLS_GUIDANCE);
     if (hasSpawnAgentTool)
         staticParts.push(SUB_AGENTS_GUIDANCE);
+    // USER + BOOTSTRAP slot in BEFORE the workspace section so the model has
+    // the operator's self-description and first-conversation guidance anchored
+    // next to the rest of the persona before it sees the workspace details.
+    if (promptMode === "full" && isCustomised(user, DEFAULT_USER)) {
+        staticParts.push(user);
+    }
+    // BOOTSTRAP.md renders ONLY when the file exists on disk. The agent self-
+    // deletes it after the first-run conversation; once gone, it stays out of
+    // the prompt for every subsequent session. The default content IS the
+    // script (name discovery + IDENTITY.md fill-in) so we DO NOT gate on
+    // customisation the way other layers do — that gate would suppress
+    // BOOTSTRAP precisely on the fresh installs where it's load-bearing.
+    if (promptMode === "full" && bootstrapExists) {
+        staticParts.push(bootstrap);
+    }
     // Workspace section. cwd is stable for the lifetime of a session — putting
     // it here (in the cached prefix) instead of the dynamic suffix saves bytes
     // per turn and gives the model a stable "where am I" anchor.
     staticParts.push(buildWorkspaceSection(cwd));
     // Project context — walks from cwd to git root looking for BRIGADE.md /
-    // AGENTS.md / CLAUDE.md / .cursorrules. Empty string when nothing found
-    // (cleanly elided by the .filter below). This is what makes per-project
-    // agent customisation work without editing the global prompt files.
+    // CLAUDE.md / .cursorrules. Empty string when nothing found (cleanly
+    // elided by the .filter below). This is what makes per-project agent
+    // customisation work without editing the global workspace files.
     if (projectContext.length > 0)
         staticParts.push(projectContext);
+    // BOOT slot — gateway-restart hook. Same render-when-customised pattern
+    // as HEARTBEAT below.
+    if (promptMode === "full" && isCustomised(boot, DEFAULT_BOOT)) {
+        staticParts.push(boot);
+    }
+    // HEARTBEAT slot — Phase-3 cron framing. Renders only when the file is
+    // customised; the embedded default reserves the slot but doesn't bloat
+    // the prompt for users who never edit it.
+    if (promptMode === "full" && isCustomised(heartbeat, DEFAULT_HEARTBEAT)) {
+        staticParts.push(heartbeat);
+    }
     staticParts.push(buildToolCatalog(toolNames, toolSummaries));
     const stablePrefix = staticParts
         .map((p) => p.trim())
@@ -871,11 +1611,11 @@ export async function refreshSessionSystemPrompt(session, cwd, options = {}) {
     return assembled.text;
 }
 /**
- * Re-export the home directory + prompt directory paths for callers that
+ * Re-export the home directory + workspace directory paths for callers that
  * need them (doctor command, integration tests, etc.).
  */
 export function getPromptDir() {
-    return path.join(BRIGADE_DIR, "prompts");
+    return getBrigadeWorkspaceDir();
 }
 /** Best-effort home dir for log messages — not used in the assembler itself. */
 export function getHomeDir() {