aimeat 1.33.2 → 1.34.0

package/dist/public/js/services/memory.js

@@ -11,8 +11,12 @@
 import { api, apiGet, apiPost, apiDelete } from '/js/api.js';
 
 /** List all memory entries. Returns array. Optional agentGaii to view another agent's memory. */
-export async function listMemories(agentGaii) {
-  const url = agentGaii ? `/v1/memory?agent=${encodeURIComponent(agentGaii)}` : '/v1/memory';
+export async function listMemories(agentGaii, opts) {
+  const p = new URLSearchParams();
+  if (agentGaii) p.set('agent', agentGaii);
+  if (opts?.archived === 'only') p.set('archived', 'only');
+  else if (opts?.archived === 'include') p.set('include_archived', 'true');
+  const url = '/v1/memory' + (p.toString() ? '?' + p.toString() : '');
   const data = await apiGet(url);
   const list = data?.data?.items || data?.data?.entries || [];
   return Array.isArray(list) ? list : [];
@@ -23,9 +27,11 @@ export async function listMemories(agentGaii) {
  * (include=meta). Fast for thousands of keys; values are fetched per-key on expand via getMemory().
  * Returns { items, quota } so the tab can render the storage-usage bar.
  */
-export async function listMemoriesMeta(agentGaii) {
+export async function listMemoriesMeta(agentGaii, opts) {
   let url = '/v1/memory?include=meta';
   if (agentGaii) url += `&agent=${encodeURIComponent(agentGaii)}`;
+  if (opts?.archived === 'only') url += '&archived=only';
+  else if (opts?.archived === 'include') url += '&include_archived=true';
   const data = await apiGet(url);
   const list = data?.data?.items || data?.data?.entries || [];
   return { items: Array.isArray(list) ? list : [], quota: data?.data?.quota || null };

package/dist/public/js/services/offers.js

@@ -95,7 +95,7 @@ export async function rankOffersByNeed(needText, items) {
   const prompt = `NEED: ${needText}\n\nCATALOGUE (${catalogue.length} offers):\n${JSON.stringify(catalogue)}`;
   const r = await api('/v1/ai/complete', {
     method: 'POST',
-    body: JSON.stringify({ prompt, systemPrompt, modelRole: 'execution', max_tokens: 900, app_id: 'offers-need-router' }),
+    body: JSON.stringify({ prompt, systemPrompt, modelRole: 'execution', app_id: 'offers-need-router' }),
     timeoutMs: 120_000, retries: 0,
   });
   if (!r?.ok) { const e = new Error(r?.error?.message || 'AI call failed'); e.code = r?.error?.code || 'UNKNOWN'; throw e; }

package/dist/public/js/services/organisms.js

@@ -390,7 +390,6 @@ export async function generateRaw(description, currentManifest) {
       prompt: frameRequest(description, currentManifest),
       systemPrompt: await generatorSystemPrompt(),
       modelRole: 'execution',
-      max_tokens: 3000,
       app_id: 'organism-workspace',
     }),
     timeoutMs: 600_000,
@@ -400,6 +399,16 @@ export async function generateRaw(description, currentManifest) {
   return String(resp?.data?.content || '');
 }
 
+/** Archive / unarchive organism content (creator/admin). `target` = { level, ws?, namespace?, key? }.
+ *  Archived content is read-only and hidden from AI materials (overview/read/search) but stays in the
+ *  archive search; archiving a container cascades, unarchiving uses smart restore. */
+export async function archiveContent(orgId, target) {
+  return apiPost(`/v1/organisms/${encodeURIComponent(orgId)}/archive`, target);
+}
+export async function unarchiveContent(orgId, target) {
+  return apiPost(`/v1/organisms/${encodeURIComponent(orgId)}/unarchive`, target);
+}
+
 /** Delete a workspace entirely — removes all organism.{id}.* memory + its schema locks. The
  *  organism stays (returns to "no workspace yet"). Deliberate typed-confirmation lives in the UI. */
 export async function deleteWorkspace(orgId, wsId) {
@@ -458,23 +467,30 @@ ${jsonText}`;
 /** Key root for one workspace — an organism holds many workspaces under organism.{id}.w.{wsId}. */
 export function wsRoot(orgId, wsId) { return `organism.${orgId}.w.${wsId}`; }
 
-export async function applyGeneratedWorkspace(orgId, wsId, generated) {
+export async function applyGeneratedWorkspace(orgId, wsId, generated, opts = {}) {
   const root = wsRoot(orgId, wsId);
   for (const [namespace, schema] of Object.entries(generated.schemas || {})) {
-    await apiPut(`/v1/memory/${encodeURIComponent(`${root}.${namespace}`)}/schema`, { schema, apply_to: 'prefix', schema_mode: 'strict' });
+    // 'open' (not 'strict'): generated schemas enforce required fields + types but TOLERATE extra fields,
+    // so later autonomous/agent writes aren't silently rejected over a stray property. The generator
+    // pre-locks structure before any real content exists; strict betoni fights every later write.
+    await apiPut(`/v1/memory/${encodeURIComponent(`${root}.${namespace}`)}/schema`, { schema, apply_to: 'prefix', schema_mode: 'open' });
   }
   const manifest = { ...generated.manifest, id: orgId, status: generated.manifest.status || 'active' };
   await apiPost('/v1/memory', { key: `${root}.meta.manifest`, value: manifest, visibility: 'private' });
   await apiPost('/v1/memory', { key: `${root}.meta.readme`, value: `# ${manifest.name || 'Workspace'}\n\n${manifest.summary || ''}`, visibility: 'private' });
   // Write any example instances as DRAFTS (clearly not-yet-published samples). Best-effort: a
-  // sample that doesn't validate is skipped, not fatal.
-  let n = 0;
-  for (const [namespace, items] of Object.entries(generated.examples || {})) {
-    if (!Array.isArray(items)) continue;
-    for (const item of items.slice(0, 5)) {
-      n++;
-      const id = String((item && item.id) || `example-${n}`).replace(/[^a-zA-Z0-9_-]/g, '-');
-      await apiPost('/v1/memory', { key: `${root}.${namespace}.${id}.draft`, value: { ...item, id }, visibility: 'private' }).catch(() => {});
+  // sample that doesn't validate is skipped, not fatal. `skipExamples` suppresses these entirely —
+  // the Secretary setup path fills workspaces with REAL content instead (fake "example-N" records read
+  // as disinformation, not examples), so it never wants placeholders.
+  if (!opts.skipExamples) {
+    let n = 0;
+    for (const [namespace, items] of Object.entries(generated.examples || {})) {
+      if (!Array.isArray(items)) continue;
+      for (const item of items.slice(0, 5)) {
+        n++;
+        const id = String((item && item.id) || `example-${n}`).replace(/[^a-zA-Z0-9_-]/g, '-');
+        await apiPost('/v1/memory', { key: `${root}.${namespace}.${id}.draft`, value: { ...item, id }, visibility: 'private' }).catch(() => {});
+      }
     }
   }
 }
@@ -483,7 +499,10 @@ export async function applyGeneratedWorkspace(orgId, wsId, generated) {
 export async function applyProjectTemplate(orgId, wsId, name, summary) {
   const root = wsRoot(orgId, wsId);
   for (const [namespace, schema] of Object.entries(PROJECT_SCHEMAS)) {
-    await apiPut(`/v1/memory/${encodeURIComponent(`${root}.${namespace}`)}/schema`, { schema, apply_to: 'prefix', schema_mode: 'strict' });
+    // 'open' (not 'strict'): generated schemas enforce required fields + types but TOLERATE extra fields,
+    // so later autonomous/agent writes aren't silently rejected over a stray property. The generator
+    // pre-locks structure before any real content exists; strict betoni fights every later write.
+    await apiPut(`/v1/memory/${encodeURIComponent(`${root}.${namespace}`)}/schema`, { schema, apply_to: 'prefix', schema_mode: 'open' });
   }
   await apiPost('/v1/memory', { key: `${root}.meta.manifest`, value: projectManifest(orgId, name, summary), visibility: 'private' });
   await apiPost('/v1/memory', { key: `${root}.meta.readme`, value: `# ${name}\n\n${summary || ''}`, visibility: 'private' });
@@ -533,8 +552,11 @@ export async function getWorkspaceActivity(orgId, wsId) {
 }
 
 /** Read the manifest-driven workspace. Returns null if the workspace has no manifest yet. */
-export async function getWorkspace(orgId, wsId) {
-  const resp = await apiGet(`/v1/organisms/${encodeURIComponent(orgId)}/workspace?ws=${encodeURIComponent(wsId)}`);
+export async function getWorkspace(orgId, wsId, opts) {
+  let url = `/v1/organisms/${encodeURIComponent(orgId)}/workspace?ws=${encodeURIComponent(wsId)}`;
+  if (opts?.archived === 'only') url += '&archived=only';
+  else if (opts?.includeArchived) url += '&includeArchived=true';
+  const resp = await apiGet(url);
   return resp?.data || null;
 }
 
@@ -1058,7 +1080,7 @@ export async function addSpace(orgId, wsId, manifest, name, mode) {
   if (mode === 'records') {
     await apiPut(`/v1/memory/${encodeURIComponent(`${wsRoot(orgId, wsId)}.${namespace}`)}/schema`, {
       schema: { type: 'object', required: ['id', 'title'], properties: { id: { type: 'string' }, title: { type: 'string' } } },
-      apply_to: 'prefix', schema_mode: 'strict',
+      apply_to: 'prefix', schema_mode: 'open',   // tolerate extra fields; enforce required/types only (see applyGeneratedWorkspace)
     });
   }
   return saveManifest(orgId, wsId, { ...manifest, objectTypes: [...(manifest.objectTypes || []), ot] });
@@ -1206,9 +1228,19 @@ export async function setImageVisibility(key, visibility) {
 //   ![alt](/v1/pub/<ownerGhii>/<key>)    — public, anyone loads it via a plain <img>
 const STORAGE_IMG_RE = /!\[([^\]]*)\]\(\/v1\/(?:storage|pub\/[^/)]+)\/([^\s)]+)\)/g;
 
-/** The current owner's GHII (`owner@node`) — used to build public /v1/pub image URLs. */
+/** The current owner's GHII (`owner@node`). ALWAYS returns a string so callers can safely `.split('@')`.
+ *  Prefers the synchronous `auth.storedGhii` accessor; falls back to a sync `getSession()` only when it
+ *  returns a session object with a string `ghii` (on some builds `getSession()` is async / returns a
+ *  Promise — never return that, or `.split` blows up at call sites). Empty string when unknown. */
 export function currentGhii() {
-  return window.AIMEAT?.auth?.getSession?.()?.ghii || '';
+  const auth = (typeof window !== 'undefined' && window.AIMEAT && window.AIMEAT.auth) || null;
+  if (!auth) return '';
+  if (typeof auth.storedGhii === 'string' && auth.storedGhii) return auth.storedGhii;
+  try {
+    const s = typeof auth.getSession === 'function' ? auth.getSession() : null;
+    if (s && typeof s === 'object' && typeof s.ghii === 'string') return s.ghii;
+  } catch { /* ignore */ }
+  return '';
 }
 
 /** Pull the storage object keys (+ alt text) embedded in a markdown document, in order (both forms). */

package/dist/public/js/services/secretary-helpers.js

@@ -5,23 +5,64 @@
  *   from AI text, a brain version-snapshot, a context id generator, and the secretary.config migration
  *   from the old single-context layout to the multi-context `{contexts[], activeContextId}` shape.
  *   See docs/plans/2026-06-23-secretary-feature.md (§5 hire, §22 multi-context).
- * @structure CONTRACT · buildInterviewPrompt · buildDesignPrompt · extractJson · snapshotOf · genCtxId · migrateConfig · buildDecisionRecord
- * @usage import { buildInterviewPrompt, extractJson, migrateConfig } from '/js/services/secretary-helpers.js';
+ * @structure CONTRACT · buildInterviewPrompt · buildDesignPrompt · extractJson · snapshotOf · genCtxId · sanitizeQuickActions · migrateConfig · buildDecisionRecord
+ * @usage import { buildInterviewPrompt, extractJson, sanitizeQuickActions, migrateConfig } from '/js/services/secretary-helpers.js';
  * @version-history
+ *   v0.6.0 — 2026-06-30 — CONTRACT steers the design toward DOCUMENT spaces (free-form markdown, the
+ *     default) and treats RECORDS spaces as the exception (only genuine lists/task-sets) — workspaces
+ *     were coming out mostly as rigid record spaces.
+ *   v0.5.0 — 2026-06-30 — Close the milestone↔goal linking gap: CONTRACT milestones now carry "goalRefs"
+ *     (the AI links each gate to the goals it gates, by 1-based goal index) + linkMilestoneGoals() to
+ *     resolve those indices to seeded goal ids, keepKnownGoalRefs() to validate re-plan id refs, and
+ *     buildStrategyReplanPrompt() now lists existing goals so re-plans preserve/relink them. Removes the
+ *     manual "tick the linked goals" step the owner used to face after setup.
+ *   v0.4.0 — 2026-06-28 — Setup interview reworked: deeper questions (current state, target, ordered
+ *     milestones, who's involved), a mandatory reflect-back-and-confirm step before any JSON, and a
+ *     closing "paste it back into AIMEAT" instruction. CONTRACT gains an OPTIONAL `direction` block
+ *     (where-we-are → where-we're-going + milestones) + normalizeDirection().
+ *   v0.3.0 — 2026-06-27 — B3: CONTRACT gains quickActions (2–3 role-specific shortcuts) + sanitizeQuickActions
+ *     — the frontend security mirror (brain/secretary may only seed prompt|compose, never a run verb).
  *   v0.2.0 — 2026-06-24 — P3-B: buildDecisionRecord — the single source of the decision-log contract
  *     shape, shared by the manual log form (use-learning), answered Ask cards (use-intake), and
  *     approved guided plans (use-guided-plan) so real choices feed the learning loop.
  *   v0.1.0 — 2026-06-23 — Extracted from views/secretary.js (Phase 2, keep view < 500 lines).
  */
 import { defaultPolicy } from '/js/services/secretary-policy.js';
+import { sanitizeProposedQuickActions } from '/js/services/secretary-rules.js';
+import { t } from '/js/i18n.js';
+
+/** G10: a human day label for a feed timestamp — Today / Yesterday / locale date. */
+export function feedDayLabel(ts) {
+  const d = new Date(ts);
+  const startOf = (x) => { const y = new Date(x); y.setHours(0, 0, 0, 0); return y.getTime(); };
+  const diffDays = Math.round((startOf(new Date()) - startOf(d)) / 86400000);
+  if (diffDays === 0) return t('secretary.feed.today');
+  if (diffDays === 1) return t('secretary.feed.yesterday');
+  return d.toLocaleDateString();
+}
+
+/** G10: group a newest-first feed list into consecutive day buckets [{ key, label, items }]. The key is
+ *  the LOCAL midnight timestamp (NOT the UTC date) so it matches the local-day label — otherwise items
+ *  straddling UTC midnight on the same local day would split into two same-labelled groups. */
+export function groupFeedByDay(feed) {
+  const groups = [];
+  let cur = null;
+  for (const it of (feed || [])) {
+    let key = 'unknown';
+    if (it.ts) { const d = new Date(it.ts); d.setHours(0, 0, 0, 0); key = String(d.getTime()); }
+    if (!cur || cur.key !== key) { cur = { key, label: it.ts ? feedDayLabel(it.ts) : '—', items: [] }; groups.push(cur); }
+    cur.items.push(it);
+  }
+  return groups;
+}
 
 /** Concise, accurate AIMEAT primer fed to the chat so the Secretary can teach/guide the user
  *  ("tutustuta AIMEATiin"). Concept-level (avoids brittle exact UI paths so it doesn't drift). */
 export const SECRETARY_AIMEAT_PRIMER = `AIMEAT is the user's own AI-agent platform. Key ideas you can explain:
 - The user owns everything under their identity (GHII). "Morsels" (❤️) are the usage/credit meter — they're spent on actions, not cashable.
 - Memory: the user's private key-value knowledge store.
-- Organisms = spaces (personal or shared) that contain Workspaces (like folders) holding structured records. The user's Secretary keeps each context's info in its own organism.
-- Agents: AI helpers the user connects (each scoped); the Secretary is one of them.
+- Organisms = spaces (personal or shared) that contain Workspaces (like folders) holding structured records. You keep each area of the user's stuff in its own organism.
+- Agents: AI helpers the user connects (each scoped); you are one of them.
 - Discover (the network search): finds what already exists across the node — agents, services, companies' offerings, knowledge, apps — so you never rebuild what's there. Always suggest discovering before building.
 - Apps, extensions, capabilities: ways to extend AIMEAT; companies can publish offerings others order.
 When the user asks how to do something in AIMEAT, explain clearly and concretely from these concepts, point them to the right area of their Profile, and offer to walk them through it step by step. If unsure, say so rather than inventing exact button names.`;
@@ -30,42 +71,104 @@ When the user asks how to do something in AIMEAT, explain clearly and concretely
 export const CONTRACT = `\`\`\`json
 {
   "brain": {
-    "purpose": "1-3 sentences: who my Secretary is and how it helps me in this context",
+    "purpose": "1-3 sentences: who you are for me and how you help me in this context",
     "rules": [ { "id": "r1", "description": "a concrete operating rule" } ]
   },
   "organism": {
     "name": "a short name for this space",
     "description": "one line describing it",
-    "workspaces": [ { "name": "workspace name", "purpose": "what it holds and why" } ]
+    "workspaces": [ { "name": "workspace name", "purpose": "what it holds and why", "manifest": "OPTIONAL — see note below", "schemas": "OPTIONAL — see note below" } ]
+  },
+  "goals": [ { "title": "a concrete goal I'm working toward in this context", "why": "why it matters" } ],
+  "quickActions": [ { "label": "short button label (<= 4 words)", "kind": "prompt", "prompt": "a ready message to send you" } ],
+  "strategy": "OPTIONAL — see note below"
+}
+\`\`\`
+
+A workspace's "manifest.objectTypes" are its SPACES, and each space is one of two kinds. PREFER DOCUMENT spaces:
+- A DOCUMENT space — free-form markdown pages about a topic (guides, write-ups, notes, plans, analysis, anything). Declare it as { "name": "<type>", "namespace": "<ns>", "mode": "document" } with NO fields and NO schema. This is the DEFAULT choice: it holds any kind of information and can be shaped freely, so most spaces should be document spaces.
+- A RECORDS space — a schema-locked list where every entry shares the SAME fixed fields. Use this ONLY when the content is genuinely a list or task-like set (a pipeline, a task list, a tracker). Declare it as { "name": "<type>", "namespace": "<ns>", "mode": "records", "fields": [ { "name": "<field>", "type": "text|number|date|select|boolean|reference" } ] } AND provide a matching JSON Schema under "schemas" keyed by its namespace.
+Lean toward document spaces; reach for a records space only when fixed, repeating fields clearly fit. Full manifest shape: { "manifestVersion": "1.0", "name": "<the workspace name>", "kind": "<short-slug>", "status": "active", "objectTypes": [ …the spaces above ] }.
+If you are NOT confident you can produce a VALID manifest + schemas, OMIT both fields for that workspace — they will be designed automatically afterward. Never output an invalid or half-finished manifest.
+
+"strategy" is the OPTIONAL steering frame for this area: where we are, where we're going, and how. Include it ONLY when the user wants this area steered that way (many goal-driven areas benefit; some areas are just ongoing upkeep — then OMIT the field entirely). EVERY sub-field is itself optional — include only the ones the user gave you real material for; never invent vision/mission/progress/names. When included:
+- "strategy": {
+    "enabled": true,
+    "vision": "the long-term aspirational picture — where this could ultimately go (optional)",
+    "mission": "what we do / our ongoing purpose in this area (optional)",
+    "principles": [ "a short guardrail that should steer decisions" ],
+    "risks": [ "something that could derail this, to watch for" ],
+    "current": "where this area honestly stands right now (the current state)",
+    "target": "the target state — what 'done well' looks like for this strategy cycle (no dates)",
+    "milestones": [ { "title": "an ordered gate on the way to the target", "enables": "what reaching it unlocks / why it matters", "criterion": "an external/judgement condition to consider it reached (optional)", "goalRefs": [1, 2], "status": "not-started" } ]
   }
+- Milestones are ORDERED and DATELESS; status is one of "not-started" | "in-progress" | "reached". A milestone is a checkpoint (a gate), NOT a task — the concrete tasks live in "goals". Base everything ONLY on what the user told you.
+- "goalRefs" links each milestone to the goals it gates: list the 1-based positions of the goals (in the "goals" array above) whose completion moves this milestone toward "reached". Every goal should serve at least one milestone, and most milestones gate at least one goal — leave "goalRefs": [] only when a milestone genuinely maps to none. This linkage is what lets a milestone advance automatically as its goals get done, so fill it in — do not leave it empty by default.`;
+
+/** When EVOLVING an existing context (re-run "reshape current"), the current setup fed back so the AI
+ *  modifies it instead of starting over — and keeps the existing workspaces stable. Empty for a new context. */
+function currentSetupText(current) {
+  if (!current) return '';
+  const rules = ((current.brain && current.brain.rules) || []).map((r) => `- ${r.description}`).join('\n');
+  const ws = (current.workspaces || []).map((w) => `- ${w.name}: ${w.purpose || ''}`).join('\n');
+  return `
+
+This area already exists, so build on what is here and evolve it.
+Current purpose: ${(current.brain && current.brain.purpose) || ''}
+Current rules:
+${rules || '(none)'}
+Current workspaces:
+${ws || '(none)'}
+Keep the existing workspaces under their current names, add a new one only when the change genuinely calls for it, and update the brain, goals and direction to reflect what changes below.`;
 }
-\`\`\``;
 
-/** Conversational interview the user runs in their own external AI chat. */
-export function buildInterviewPrompt(owner) {
-  return `I want to set up a context for my personal Secretary inside AIMEAT${owner ? ` (my username is "${owner}")` : ''}.
+/** Conversational interview the user runs in their own external AI chat. `current` (optional) = the
+ *  context being re-run, so the AI EVOLVES it (reshape) instead of starting fresh. */
+export function buildInterviewPrompt(owner, current) {
+  return `I want to ${current ? 'evolve the' : 'set up an'} AI that works alongside me inside AIMEAT and helps me handle everything I have going on across my work and life${owner ? ` (my username is "${owner}")` : ''}.
+
+You are that, and this is the start of us working together. You take things off my plate and move my work forward, and you become whatever I need you to be — there is no fixed job title here, only what helps me most. Treat it as a real, flowing conversation between two people. Your aim: genuinely understand my world and what I have going on, be useful to me from the very first message, and by the end arrive at genuinely good "brains" for yourself, so you clearly know how to help me across all of it, my goals are sharp, and you have spaces ready to fill with well-organized information as we go. You handle the whole picture and organize what I bring into its own spaces yourself, so I can hand you anything and trust it lands in the right place.
+
+Take whatever I bring you in stride: it is all welcome, however much there is, and a big, busy picture is exactly where you are most useful. Stay calm and can-do, and meet a large scope with energy. Keep any concern for the moments when something is genuinely serious and worth my attention; right now we are getting to know things, so stay light, curious, and encouraging.
 
-Act as that Secretary getting to know me for ONE area of my life or work. Interview me with a few focused questions about: what I'm trying to achieve in this area, the kinds of tasks I'd want help with, and how I like to communicate (tone, language, level of detail). Do NOT ask me about "organisms", "workspaces", folders or any technical structure — figure the right structure out yourself from what I tell you. Keep it conversational; ask, wait for my answers, then continue.
+Begin by grounding yourself in what already exists. Your very first move, while you have AIMEAT tools available, is to look up what I already have — my organisms, their workspaces, and recent activity — and open the conversation from that real picture, naming only what you actually find there and building on it. When AIMEAT tools are out of reach, open instead by asking me for a quick picture of what I have going on. Either way, start from what is really there.
 
-When you have enough, design two things and output them as ONE JSON object inside a single code block with EXACTLY this shape and nothing else:
+Lead with the conversation and let it lead everywhere. Talk the way a sharp, warm colleague talks: plain, simple, everyday language, in my own language. Stay curious and genuinely helpful: when I bring up an approach, a tool, or a question, take it seriously, build on it, and help me with it right there; and when you can move something forward in the moment (look something up, draft something, check whether something already exists), do it then. You have AIMEAT tools and knowledge available, so use them to help me and to ask sharper questions.
+
+You know AIMEAT, so you can explain it and suggest how it helps here:
+${SECRETARY_AIMEAT_PRIMER}
+
+Follow me, and come to understand, in whatever order it surfaces: what I have going on across my work and life and where things honestly stand right now; what I need you for and how you can best help me; and, as it comes up, where I want to take things and how we get there. Keep your questions few and focused, one small batch at a time, and let my answers shape the next ones. Where you have a hunch, from what you know about me or what you can find, offer it as a suggestion I can shape ("maybe you're aiming at X, or is it something else?") and let me steer.
+
+Keep your words to me human and plain, and work out any underlying structure quietly on your own from what I tell you, holding it in the background.${currentSetupText(current)}
+
+As we talk, work toward one clear picture we both share, and say it back to me in plain words (your own, grounded in what we covered and what you looked up — a few sentences, not a labelled form): where things honestly stand now, where this is ultimately heading (the vision), and what success looks like for the near term (the target). Make that picture hang together as one coherent story, so each piece follows from the one before. Anything you then suggest doing is a step that plainly serves that target and connects to the rest, expressed as a real, concrete outcome a sharp colleague would immediately understand. Say everything plainly enough that I nod and recognize it as true; when a phrase would puzzle me, swap it for the plain thing you mean, and keep invented terms and strategy-speak out of it.
+
+Hold the right altitude, and use your judgment to keep it there. The vision, target and milestones describe real outcomes — where this area is genuinely heading and what reaching it changes, in this area's own terms, whatever they are. The concrete to-dos (prepare a thing, send a message, make a list) are everyday work that belongs in the space, never a goal or a milestone. Before you settle on the picture, step back and judge it the way a thoughtful person would: is this the real shape of where we are going, or a list of tasks dressed up as strategy? If it reads as busywork, or it does not hang together sensibly, rework it until it earns its place.
+
+Once that picture feels right to me — I will tell you when it clicks — capture everything we landed on as ONE JSON object inside a single code block in exactly this shape:
 
 ${CONTRACT}
 
-Constraints: 3–7 brain rules; 2–6 workspaces, each designed from my actual needs. Output ONLY the JSON code block.`;
+Fill it from the picture we confirmed: the brain (who you are for me and how you help, written as clear operating rules), the space and what it will hold so information stays organized as it accumulates, the direction (the vision, where we are now, and the target we agreed), my goals (each one a concrete outcome that plainly serves that target and connects to the rest — never a list of disconnected tasks), and a couple of quick actions. Keep it to 3–7 brain rules, 2–6 workspaces drawn from my actual needs, 2–3 goals, and 2–3 quickActions, each kind being either "prompt" (a ready message to send me) or "compose" (focus an input, with "target" one of "plan"|"find"|"note"). Keep the JSON as one self-contained code block so the app can read it.
+
+After the JSON, add one short line in my language: go back to AIMEAT → the Secretary page → paste this into the setup box → "Set up my Secretary".`;
 }
 
-/** Single-shot design prompt for the in-app mode (runs on the owner's OpenRouter key). */
-export function buildDesignPrompt(owner, needs) {
-  return `You are setting up one context of ${owner || 'a user'}'s personal Secretary inside AIMEAT. Based ONLY on the needs described below, design two things and output them as ONE JSON object inside a single code block with EXACTLY this shape and nothing else:
+/** Single-shot design prompt for the in-app mode (runs on the owner's OpenRouter key). `current`
+ *  (optional) = the context being re-run, so the AI EVOLVES it (reshape) and keeps its workspaces. */
+export function buildDesignPrompt(owner, needs, current) {
+  return `You are setting up ${current ? 'and evolving ' : ''}one context of the AI that works alongside ${owner || 'a user'} inside AIMEAT (it takes things off their plate and moves their work forward — no fixed job title, only what helps most). Based ONLY on the needs described below${current ? ' and the current setup' : ''}, design these things and output them as ONE JSON object inside a single code block with EXACTLY this shape and nothing else:
 
 ${CONTRACT}
+${currentSetupText(current)}
 
 The user's needs:
 """
 ${needs}
 """
 
-Constraints: 3–7 brain rules; 2–6 workspaces (you choose names + purposes from the needs). Output ONLY the JSON code block — no commentary.`;
+Constraints: 3–7 brain rules; 2–6 workspaces (you choose names + purposes from the needs); 2–3 goals (concrete things the user is working toward); 2–3 quickActions (role-specific shortcut buttons), each "kind" being either "prompt" (a ready message) or "compose" (focus an input, with "target" one of "plan"|"find"|"note"). Include the "strategy" object (vision/mission/principles/risks/current → target → ordered milestones, using the parts the needs support) when the needs describe a goal-driven area heading somewhere, and leave it out for areas that are ongoing upkeep. Hold the right altitude: the strategy and goals are real outcomes — where this area is heading and what reaching it changes, in its own terms — while concrete to-dos (prepare a thing, send a message, make a list) belong in a workspace, never as a goal or milestone. Before you output, judge the result the way a thoughtful person would: if a goal or milestone reads as busywork or a task dressed up as strategy, rework it until it is a real outcome that hangs together. Ground everything in the needs as given. Output the single JSON code block on its own.`;
 }
 
 /** Pull a JSON object out of an AI's text (may be fenced / surrounded by prose). */
@@ -92,6 +195,18 @@ export function genCtxId() {
   return 'ctx-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 5);
 }
 
+function genActionId() { return 'qa-' + Date.now().toString(36) + Math.random().toString(36).slice(2, 5); }
+
+/**
+ * Sanitize brain-seeded / secretary-proposed dynamic quick actions (B3). The SECURITY boundary (only
+ * prompt|compose, never a 'run' verb) lives in the shared, dependency-free rules module
+ * (/js/services/secretary-rules.js), which MIRRORS the server's secretary-tick.ts and is proven equal by
+ * e2e-secretary's G6 parity test. Here we just stamp an id + createdAt onto each sanitized action.
+ */
+export function sanitizeQuickActions(raw, source, status = 'proposed') {
+  return sanitizeProposedQuickActions(raw, source, status).map((a) => ({ id: genActionId(), ...a, createdAt: new Date().toISOString() }));
+}
+
 /** Cheap, AI-free context routing (plan §22 step 2): score `text` against each context's name +
  *  purpose + workspaces by word overlap. Returns {id,name} of a NON-active context only when it
  *  clearly beats the active one — so the view can SUGGEST a switch. Null otherwise (no nagging). */
@@ -165,6 +280,136 @@ export function migrateConfig(cfg, directives) {
   return { config: { contexts: [], activeContextId: null }, changed: false };
 }
 
+/** Valid milestone statuses for the optional "strategy" steering structure. */
+export const MILESTONE_STATUSES = ['not-started', 'in-progress', 'reached'];
+
+let _msSeq = 0;
+/** Stable-ish id for a milestone (needed so goals can reference it + for list keys). */
+function genMilestoneId() { return 'ms-' + Date.now().toString(36) + (_msSeq++).toString(36) + Math.random().toString(36).slice(2, 4); }
+
+/** Coerce a free-form list field (principles/risks) to an array of non-empty short strings. */
+function strList(v) {
+  const arr = Array.isArray(v) ? v : (typeof v === 'string' && v.trim() ? [v] : []);
+  return arr.map((x) => String((x && x.text) || x || '').trim().slice(0, 400)).filter(Boolean).slice(0, 20);
+}
+
+/** Normalize a context's optional `strategy` (from interview/design JSON or stored config) into the
+ *  canonical shape: `{ enabled, vision, mission, principles[], risks[], current, target, milestones[] }`
+ *  where each milestone is `{ id, title, enables, goalRefs[], criterion, status }`. A missing object, a
+ *  non-object, or `enabled:false` yields a disabled (hidden) strategy. Every sub-field is optional; the
+ *  card shows only the filled ones. Milestones keep their order (a gate; reach one before the next),
+ *  empty-title ones are dropped, ids are stamped if absent, and statuses are coerced to a valid value. */
+export function normalizeStrategy(s) {
+  const empty = { enabled: false, vision: '', mission: '', principles: [], risks: [], current: '', target: '', milestones: [] };
+  if (!s || typeof s !== 'object' || s.enabled === false) return empty;
+  const ms = Array.isArray(s.milestones) ? s.milestones : [];
+  return {
+    enabled: true,
+    vision: String(s.vision || '').slice(0, 4000),
+    mission: String(s.mission || '').slice(0, 4000),
+    principles: strList(s.principles),
+    risks: strList(s.risks),
+    current: String(s.current || '').slice(0, 4000),
+    target: String(s.target || '').slice(0, 4000),
+    milestones: ms.map((m) => ({
+      id: (m && typeof m.id === 'string' && m.id) ? m.id : genMilestoneId(),
+      title: String((m && m.title) || '').slice(0, 300),
+      enables: String((m && (m.enables || m.who)) || '').slice(0, 600),
+      goalRefs: Array.isArray(m && m.goalRefs) ? m.goalRefs.map((g) => String(g)).filter(Boolean).slice(0, 50) : [],
+      criterion: String((m && m.criterion) || '').slice(0, 600),
+      status: MILESTONE_STATUSES.includes(m && m.status) ? m.status : 'not-started',
+    })).filter((m) => m.title),
+  };
+}
+
+/** Suggested milestone status from its linked goals (Phase-2 helper): all linked goals done → "reached";
+ *  any linked goal exists and at least one is done/in-flight → "in-progress"; otherwise unchanged. Pure;
+ *  the owner confirms (some milestones also carry an external `criterion` that is a judgement call). */
+export function suggestMilestoneStatus(milestone, goalsById) {
+  const refs = (milestone && milestone.goalRefs) || [];
+  if (!refs.length) return milestone.status || 'not-started';
+  const linked = refs.map((id) => goalsById[id]).filter(Boolean);
+  if (!linked.length) return milestone.status || 'not-started';
+  const done = linked.filter((g) => g.status === 'done').length;
+  if (done === linked.length) return 'reached';
+  if (done > 0) return 'in-progress';
+  return milestone.status || 'not-started';
+}
+
+/** Resolve milestone goalRefs the setup/design AI produced as 1-based indices into the same JSON's
+ *  `goals` array (it cannot know the runtime goal ids, so it links by position) to the real goal ids
+ *  assigned at seed time. `idsInOrder` is the seeded goal ids in goals[] order (null for any goal that
+ *  was skipped or failed to persist). Refs that don't resolve to a real id are dropped; pass [] to strip
+ *  every index ref (e.g. when goals were not seeded, so no link can be made). Returns a new strategy;
+ *  non-strategy input passes through unchanged. Run this AFTER normalizeStrategy. */
+export function linkMilestoneGoals(strategy, idsInOrder) {
+  if (!strategy || typeof strategy !== 'object' || !Array.isArray(strategy.milestones)) return strategy;
+  const ids = Array.isArray(idsInOrder) ? idsInOrder : [];
+  return {
+    ...strategy,
+    milestones: strategy.milestones.map((m) => {
+      const refs = Array.isArray(m && m.goalRefs) ? m.goalRefs : [];
+      const mapped = refs
+        .map((r) => { const n = Number(r); return Number.isInteger(n) && n >= 1 && n <= ids.length ? ids[n - 1] : null; })
+        .filter(Boolean);
+      return { ...m, goalRefs: mapped };
+    }),
+  };
+}
+
+/** Keep only the milestone goalRefs that point at a goal that actually exists (matched by id) — used
+ *  after a re-plan, where the AI links milestones to EXISTING goal ids and could name one that's gone. */
+export function keepKnownGoalRefs(strategy, validIds) {
+  if (!strategy || typeof strategy !== 'object' || !Array.isArray(strategy.milestones)) return strategy;
+  const ok = new Set((validIds || []).filter(Boolean).map((x) => String(x)));
+  return {
+    ...strategy,
+    milestones: strategy.milestones.map((m) => ({
+      ...m,
+      goalRefs: (Array.isArray(m && m.goalRefs) ? m.goalRefs : []).filter((r) => ok.has(String(r))),
+    })),
+  };
+}
+
+/** Build a re-plan prompt: given the CURRENT strategy + what the owner just changed (e.g. a new target
+ *  state), ask the AI to propose an UPDATED strategy that stays coherent — keep what still fits, adjust
+ *  milestones/principles/risks toward the new target. Returns ONLY a `{ "strategy": {...} }` JSON object,
+ *  so the same extractJson + normalizeStrategy path applies. Used by both the in-app (OpenRouter) re-plan
+ *  and the copy-to-chat re-plan. `changeNote` is the human description of what changed. */
+export function buildStrategyReplanPrompt(owner, strategy, changeNote, goals) {
+  const cur = normalizeStrategy(strategy);
+  const ms = (cur.milestones || []).map((m, i) => {
+    const links = (m.goalRefs || []).length ? ` — gates goals: ${m.goalRefs.join(', ')}` : '';
+    return `${i + 1}. [${m.status}] ${m.title}${m.enables ? ` — enables: ${m.enables}` : ''}${links}`;
+  }).join('\n') || '(none)';
+  const goalList = (Array.isArray(goals) ? goals : []).filter((g) => g && g.id && g.title)
+    .map((g) => `- [${g.id}] ${g.title}${g.status ? ` (${g.status})` : ''}`).join('\n') || '(none)';
+  return `You are helping ${owner || 'a user'} re-plan the strategy for one area of their work inside AIMEAT. The user just changed something and the rest of the strategy should be adjusted to stay coherent — KEEP whatever still fits, and only change what the change implies. Do not invent facts or progress; preserve the status of milestones that are still valid.
+
+Current strategy:
+- Vision: ${cur.vision || '(none)'}
+- Mission: ${cur.mission || '(none)'}
+- Principles: ${cur.principles.join(' | ') || '(none)'}
+- Risks: ${cur.risks.join(' | ') || '(none)'}
+- Current state: ${cur.current || '(none)'}
+- Target state: ${cur.target || '(none)'}
+- Milestones (in order):\n${ms}
+
+The user's existing goals in this area (link milestones to these by their [id] in "goalRefs"):
+${goalList}
+
+What changed:
+"""
+${String(changeNote || '').slice(0, 2000)}
+"""
+
+Output ONE JSON object inside a single code block and nothing else, with this shape:
+\`\`\`json
+{ "strategy": { "enabled": true, "vision": "", "mission": "", "principles": [], "risks": [], "current": "", "target": "", "milestones": [ { "title": "", "enables": "", "criterion": "", "goalRefs": [], "status": "not-started|in-progress|reached" } ] } }
+\`\`\`
+Keep milestones ORDERED and dateless; carry over the status of milestones that still apply. Set each milestone's "goalRefs" to the [id]s (exact id strings from the goals list above) of the goals it gates — carry over the existing links shown next to each milestone, and [] only when a milestone gates none. Output ONLY the JSON code block.`;
+}
+
 /** Path to the decision-log Memory Contract spec (mirrors use-learning.js). */
 export const DECISION_SPEC = 'docs/specs/secretary-decision-contract.md';
 

package/dist/public/js/services/secretary-policy.js

@@ -31,6 +31,7 @@ export const SECRETARY_CAPABILITIES = [
   { id: 'file_intake',         defaultBand: 'act' },
   { id: 'briefing',            defaultBand: 'act' },
   { id: 'reminders',           defaultBand: 'act' },
+  { id: 'author_content',      defaultBand: 'off',   costs: true },
   { id: 'curate_knowledge',    defaultBand: 'draft' },
   { id: 'draft_replies',       defaultBand: 'draft' },
   { id: 'create_resource',     defaultBand: 'ask' },

package/dist/public/js/services/secretary-rules.js

@@ -0,0 +1,70 @@
+/**
+ * @file secretary-rules.js
+ * @description Pure, dependency-FREE Secretary rules shared across the browser. Two security/behaviour
+ *   boundaries that also exist server-side and MUST stay identical:
+ *     - routeRoutineStep(step, bands)          — band-gate a Routine step (act → run · draft|ask → confirm · off → skip).
+ *     - sanitizeProposedQuickActions(raw, …)   — the dynamic-quick-action security gate (only prompt|compose, never run).
+ *   These MIRROR `src/services/secretary-tick.ts` (the browser can't import the TS server module, and the
+ *   server can't import an importmap `/js/...` module). Because this file has ZERO imports, the E2E harness
+ *   (run via tsx, which doesn't type-check `test/`) imports it DIRECTLY and runs the same vectors through it
+ *   AND the TS helpers — so e2e-secretary's parity test PROVES the two copies agree (gap G6). Keep both
+ *   sides byte-equivalent; if you change one, change the other and the parity vectors will confirm it.
+ * @structure BANDS · routeRoutineStep · sanitizeProposedQuickActions
+ * @usage import { routeRoutineStep, sanitizeProposedQuickActions } from '/js/services/secretary-rules.js';
+ * @version-history
+ *   v0.1.0 — 2026-06-28 — G6: extract the cross-runtime rules to a pure shared module + parity test.
+ */
+
+/** Autonomy bands, least → most restrictive. */
+export const BANDS = ['act', 'draft', 'ask', 'off'];
+
+/** Inputs a `compose` quick action may focus (must match the working cards the view renders). */
+const QUICK_COMPOSE_TARGETS = new Set(['plan', 'find', 'note']);
+
+/**
+ * Band-gate a Routine step. A valid step-level `band` override wins, else the policy band, else the
+ * conservative 'ask'. act → run · draft|ask → confirm · off → skip. (Mirror of secretary-tick.ts.)
+ */
+export function routeRoutineStep(step, bands) {
+  const capability = String((step && step.capability) != null ? step.capability : '').trim();
+  const override = (step && typeof step.band === 'string' && BANDS.includes(step.band)) ? step.band : null;
+  const band = override != null ? override
+    : ((bands && typeof bands[capability] === 'string') ? bands[capability] : 'ask');
+  const disposition = band === 'off' ? 'skip' : band === 'act' ? 'run' : 'confirm';
+  return { band, disposition };
+}
+
+/**
+ * Sanitize brain-seeded / secretary-proposed quick actions — the SECURITY boundary: a non-core action may
+ * ONLY be 'prompt' (a canned chat message) or 'compose' (focus an input) — never a 'run' verb. Malformed
+ * entries are dropped. Returns normalized actions WITHOUT id/createdAt (callers stamp those). (Mirror of
+ * secretary-tick.ts::sanitizeProposedQuickActions.)
+ */
+export function sanitizeProposedQuickActions(raw, source, status = 'proposed') {
+  const list = Array.isArray(raw) ? raw : [];
+  const out = [];
+  for (const r of list) {
+    if (!r || typeof r !== 'object') continue;
+    const label = String(r.label != null ? r.label : '').trim().slice(0, 40);
+    const kind = String(r.kind != null ? r.kind : '').trim();
+    if (!label) continue;
+    if (kind === 'compose') {
+      const target = String(r.target != null ? r.target : '').trim();
+      if (!QUICK_COMPOSE_TARGETS.has(target)) continue;
+      out.push({ label, kind: 'compose', target, source, status });
+    } else if (kind === 'prompt') {
+      const prompt = String(r.prompt != null ? r.prompt : '').trim().slice(0, 500);
+      if (!prompt) continue;
+      out.push({ label, kind: 'prompt', prompt, source, status });
+    }
+    // kind === 'run' (or anything else) → dropped: the explicit security boundary.
+  }
+  return out.slice(0, 6);
+}
+
+/** True iff a stored quick action is allowed (a well-formed prompt|compose, never a run verb). Derived
+ *  from sanitizeProposedQuickActions so the rule has a single definition. Used to scrub config server-side. */
+export function isAllowedQuickAction(a) {
+  // status doesn't affect validity (only kind/label/target/prompt do) — pass a fixed valid status.
+  return sanitizeProposedQuickActions([a], (a && a.source) || '', 'active').length === 1;
+}