create-workframe 0.1.26 → 0.1.28

package/README.md

@@ -3,7 +3,7 @@
 Published on npm as **create-workframe**.
 
 ```bash
-npx create-workframe@0.1.26 MyProject
+npx create-workframe@0.1.28 MyProject
 ```
 
 Scaffolds an isolated Workframe + Hermes project on Windows, macOS, and Linux.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-workframe",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "Scaffold a Workframe + Hermes workspace with guided onboarding",
   "type": "module",
   "bin": {

package/workframe-api/handler_modules/handler_auth.py

@@ -535,7 +535,7 @@ class AuthRoutesMixin:
             tagline=tagline,
         )
         if soul:
-            result = srv.profile_soul_set(native_slug, soul)
+            result = srv.profile_soul_set(native_slug, soul, layer="admin")
             if not result.get("ok"):
                 self._json(400, result)
                 return

package/workframe-api/handler_modules/handler_chat.py

@@ -337,7 +337,25 @@ class ChatRoutesMixin:
             self._json(404, {"error": "not found"})
             return
         profile = resolve_validated_profile(profile_soul_match.group(1))
-        self._json(200, profile_soul_get(profile))
+        ws_id = ""
+        user_id = str(getattr(self, "auth_user", "") or "")
+        if user_id:
+            try:
+                conn = srv._workframe_db()
+                row = conn.execute(
+                    """
+                    SELECT workspace_id FROM workspace_memberships
+                    WHERE user_id = ? AND status = 'active' AND deleted_at IS NULL
+                    ORDER BY created_at ASC LIMIT 1
+                    """,
+                    (user_id,),
+                ).fetchone()
+                conn.close()
+                if row:
+                    ws_id = str(row["workspace_id"])
+            except sqlite3.Error:
+                pass
+        self._json(200, profile_soul_get(profile, ws_id))
 
 
     def _route_pattern_get_hermes_profile_detail(self, path: str, qs: dict[str, list[str]]) -> None:
@@ -580,7 +598,8 @@ class ChatRoutesMixin:
             return
         profile = resolve_validated_profile(profile_soul_post.group(1))
         soul = str(body.get("soul", body.get("text", "")))
-        self._json(200, profile_soul_set(profile, soul))
+        layer = str(body.get("layer") or "").strip()
+        self._json(200, profile_soul_set(profile, soul, layer=layer))
 
 
     def _route_pattern_post_hermes_profile_bind(self, path: str, body: dict) -> None:

package/workframe-api/hermes_admin.py

@@ -464,7 +464,8 @@ def hermes_profile_detail(profile: str, workspace_id: str = "") -> dict[str, Any
     prof = _srv().resolve_validated_profile(profile)
     reg = _srv()._agent_registry_row(prof)
     db_row = _agent_db_row(prof, workspace_id)
-    soul_text = _srv()._profile_soul_text(prof)
+    soul_layers = profile_soul_get(prof, workspace_id)
+    soul_text = str(soul_layers.get("composed") or soul_layers.get("soul") or "")
     block = _srv()._read_model_block(prof)
     try:
         state = _srv().gateway_data(prof)
@@ -486,6 +487,11 @@ def hermes_profile_detail(profile: str, workspace_id: str = "") -> dict[str, Any
         "description": str(reg.get("description") or ""),
         "soul": soul_text,
         "soul_exists": bool(soul_text),
+        "soul_system": str(soul_layers.get("system") or ""),
+        "soul_admin": str(soul_layers.get("admin") or ""),
+        "soul_workspace_spice": str(soul_layers.get("workspace_spice") or ""),
+        "soul_user": str(soul_layers.get("user") or ""),
+        "soul_composed": soul_text,
         "gateway_running": gateway_running,
         "gateway_state": gateway_state,
         "model": block.get("default", ""),
@@ -520,30 +526,56 @@ def hermes_profile_update(profile: str, body: dict[str, Any]) -> dict[str, Any]:
     return {"ok": True, "profile": prof, **patch}
 
 
-def profile_soul_get(profile: str) -> dict[str, Any]:
+def profile_soul_get(profile: str, workspace_id: str = "") -> dict[str, Any]:
     prof = _srv().resolve_validated_profile(profile)
-    text = _srv()._profile_soul_text(prof)
+    template = (
+        _srv()._runtime_template_slug(prof) if _srv()._is_runtime_profile_slug(prof) else prof
+    )
+    system = _srv()._profile_base_soul_text(prof)
+    admin = ""
+    if _srv()._is_native_profile(template):
+        admin = str(_srv()._agent_registry_row(template).get("admin_soul") or "").strip()
+    workspace_spice = _srv()._workspace_agent_spice(workspace_id)
+    user = _srv()._profile_user_soul(prof)
+    composed = _srv()._profile_soul_text(prof, workspace_id)
     path = _srv()._profile_soul_path(prof)
     return {
         "ok": True,
         "profile": prof,
-        "soul": text,
+        "soul": composed,
+        "system": system,
+        "admin": admin,
+        "workspace_spice": workspace_spice,
+        "user": user,
+        "composed": composed,
         "path": str(path),
         "exists": path.is_file(),
     }
 
 
-def profile_soul_set(profile: str, soul: str) -> dict[str, Any]:
+def profile_soul_set(profile: str, soul: str, layer: str = "") -> dict[str, Any]:
     prof = _srv().resolve_validated_profile(profile)
-    if _srv()._is_native_profile(prof):
-        path = _srv()._profile_soul_path(prof)
-        path.parent.mkdir(parents=True, exist_ok=True)
-        normalized = soul if not soul or soul.endswith("\n") else f"{soul}\n"
-        path.write_text(normalized, encoding="utf-8")
-        return {"ok": True, "profile": prof, "bytes": len(normalized.encode("utf-8")), "target": "soul_file"}
     lookup = _srv()._runtime_template_slug(prof) if _srv()._is_runtime_profile_slug(prof) else prof
-    _srv()._apply_profile_identity(lookup, user_soul=soul)
-    return {"ok": True, "profile": prof, "bytes": len(soul.encode("utf-8")), "target": "user_soul_overlay"}
+    layer_name = str(layer or "").strip().lower()
+    if not layer_name:
+        layer_name = "admin" if _srv()._is_native_profile(lookup) else "user"
+    if layer_name == "admin":
+        if not _srv()._is_native_profile(lookup):
+            return {"ok": False, "error": "admin_layer_native_only", "profile": prof}
+        _srv()._apply_profile_identity(lookup, admin_soul=soul)
+        target = "admin_soul"
+    elif layer_name == "user":
+        _srv()._apply_profile_identity(lookup, user_soul=soul)
+        target = "user_soul"
+    else:
+        return {"ok": False, "error": "invalid_layer", "profile": prof, "allowed_layers": ["admin", "user"]}
+    return {
+        "ok": True,
+        "profile": prof,
+        "bytes": len(str(soul or "").encode("utf-8")),
+        "target": target,
+        "layer": layer_name,
+    }
 
 
 def hermes_debug() -> dict[str, Any]:

package/workframe-api/hermes_profiles.py

@@ -434,6 +434,7 @@ def _seed_native_user_overlay(
     role: str = "",
     tagline: str = "",
     user_soul: str = "",
+    admin_soul: str = "",
 ) -> None:
     """Keep template SOUL/AGENTS on disk; layer user identity in registry overlay."""
     runtime = _srv().safe_profile_slug(runtime)
@@ -441,14 +442,18 @@ def _seed_native_user_overlay(
     if not runtime:
         return
     _write_profile_soul_if_stub(runtime, template)
-    if display_name.strip() or role.strip() or tagline.strip() or user_soul.strip():
-        _apply_profile_identity(
-            runtime,
-            display_name=display_name,
-            role=role,
-            tagline=tagline,
-            user_soul=user_soul,
-        )
+    overlay_soul = admin_soul.strip() or user_soul.strip()
+    if display_name.strip() or role.strip() or tagline.strip() or overlay_soul:
+        identity_kwargs: dict[str, str] = {
+            "display_name": display_name,
+            "role": role,
+            "tagline": tagline,
+        }
+        if _is_native_profile(template):
+            identity_kwargs["admin_soul"] = admin_soul.strip() or user_soul.strip()
+        elif user_soul.strip():
+            identity_kwargs["user_soul"] = user_soul.strip()
+        _apply_profile_identity(runtime, **identity_kwargs)
 
 
 def _apply_profile_identity(
@@ -458,6 +463,7 @@ def _apply_profile_identity(
     role: str = "",
     tagline: str = "",
     user_soul: str = "",
+    admin_soul: str = "",
 ) -> None:
     prof = _srv().safe_profile_slug(profile)
     patch: dict[str, Any] = {}
@@ -467,6 +473,8 @@ def _apply_profile_identity(
         patch["role"] = role.strip()
     if tagline.strip():
         patch["tagline"] = tagline.strip()
+    if admin_soul.strip():
+        patch["admin_soul"] = admin_soul.strip()
     if user_soul.strip():
         patch["user_soul"] = user_soul.strip()
     if patch.get("display_name"):
@@ -477,18 +485,65 @@ def _apply_profile_identity(
         _srv()._upsert_agent_registry_row(prof, patch)
 
 
-def _profile_identity_overlay(profile: str) -> str:
+def _template_slug_for_profile(profile: str) -> str:
+    prof = _srv().safe_profile_slug(str(profile or "").strip())
+    if _srv()._is_runtime_profile_slug(prof):
+        return _runtime_template_slug(prof)
+    return prof
+
+
+def _workspace_agent_spice(workspace_id: str) -> str:
+    workspace_id = str(workspace_id or "").strip()
+    if not workspace_id:
+        return ""
+    try:
+        conn = _srv()._workframe_db()
+        row = conn.execute(
+            "SELECT settings_json FROM workspaces WHERE id = ? AND deleted_at IS NULL",
+            (workspace_id,),
+        ).fetchone()
+        conn.close()
+        if row:
+            settings = _srv()._parse_workspace_settings(row)
+            return str(settings.get("agent_spice") or "").strip()
+    except (sqlite3.Error, OSError):
+        pass
+    return ""
+
+
+def _profile_admin_soul(profile: str) -> str:
+    template = _template_slug_for_profile(profile)
+    if not _is_native_profile(template):
+        return ""
+    return str(_srv()._agent_registry_row(template).get("admin_soul") or "").strip()
+
+
+def _profile_user_soul(profile: str) -> str:
+    prof = _srv().safe_profile_slug(profile)
+    template = _template_slug_for_profile(prof)
+    if _is_native_profile(template):
+        return ""
+    if _srv()._is_runtime_profile_slug(prof):
+        runtime_reg = _srv()._agent_registry_row(prof)
+        reg = _srv()._agent_registry_row(template)
+        return str(runtime_reg.get("user_soul") or reg.get("user_soul") or "").strip()
+    return str(_srv()._agent_registry_row(prof).get("user_soul") or "").strip()
+
+
+def _profile_identity_overlay(profile: str, workspace_id: str = "") -> str:
     prof = _srv().safe_profile_slug(profile)
     if _srv()._is_runtime_profile_slug(prof):
         template = _runtime_template_slug(prof)
-        # Keep runtime-local instructions separate from shared display
-        # identity.  Name/role/tagline/avatar must come from the template.
         reg = _srv()._agent_registry_row(template)
-        runtime_reg = _srv()._agent_registry_row(prof)
     else:
         reg = _srv()._agent_registry_row(prof)
-        runtime_reg = {}
     blocks: list[str] = []
+    admin_soul = _profile_admin_soul(prof)
+    if admin_soul:
+        blocks.append("## Manager identity\n" + admin_soul)
+    spice = _srv()._workspace_agent_spice(workspace_id)
+    if spice:
+        blocks.append("## Workspace preferences\n" + spice)
     identity_lines: list[str] = []
     display = str(reg.get("display_name") or "").strip()
     role = str(reg.get("role") or reg.get("description") or "").strip()
@@ -501,9 +556,9 @@ def _profile_identity_overlay(profile: str) -> str:
         identity_lines.append(f"- **Tagline:** {tagline}")
     if identity_lines:
         blocks.append("## User identity\n" + "\n".join(identity_lines))
-    user_soul = str(runtime_reg.get("user_soul") or reg.get("user_soul") or "").strip()
+    user_soul = _profile_user_soul(prof)
     if user_soul:
-        blocks.append("## Additional instructions\n" + user_soul)
+        blocks.append("## User preferences\n" + user_soul)
     return "\n\n".join(blocks).strip()
 
 
@@ -554,9 +609,9 @@ def _profile_base_soul_text(profile: str) -> str:
     return _render_soul_placeholders(raw).strip()
 
 
-def _profile_soul_text(profile: str) -> str:
+def _profile_soul_text(profile: str, workspace_id: str = "") -> str:
     base = _profile_base_soul_text(profile)
-    overlay = _profile_identity_overlay(profile)
+    overlay = _profile_identity_overlay(profile, workspace_id)
     if base and overlay:
         return f"{base.rstrip()}\n\n---\n\n{overlay}"
     return overlay or base

package/workframe-api/profile_gateway.py

@@ -292,7 +292,22 @@ def _profile_turn_payload(profile: str, text: str, room_id: str = "") -> dict[st
         except Exception:  # noqa: BLE001
             pass
     payload: dict[str, Any] = {"message": message}
-    soul = _srv()._profile_soul_text(profile)
+    workspace_id = ""
+    if room_id:
+        try:
+            conn = _srv()._workframe_db()
+            try:
+                room = conn.execute(
+                    "SELECT workspace_id FROM rooms WHERE id = ? AND deleted_at IS NULL",
+                    (room_id,),
+                ).fetchone()
+                if room and room["workspace_id"]:
+                    workspace_id = str(room["workspace_id"])
+            finally:
+                conn.close()
+        except Exception:  # noqa: BLE001
+            pass
+    soul = _srv()._profile_soul_text(profile, workspace_id)
     if soul:
         payload["instructions"] = soul
     return payload

package/workframe-api/rooms.py

@@ -136,6 +136,7 @@ def _workspace_payload(row: sqlite3.Row, *, viewer_role: str = "") -> dict[str,
     payload["integrations"] = integrations
     payload["credential_mode"] = str(settings.get("credential_mode") or "byok").strip() or "byok"
     payload["tagline"] = str(settings.get("tagline") or "")
+    payload["agent_spice"] = str(settings.get("agent_spice") or "")
     if viewer_role in OWNER_ADMIN_ROLES:
         payload["admin_onboarding_done"] = bool(settings.get("admin_onboarding_done"))
     return payload
@@ -910,10 +911,11 @@ def _patch_workspace(workspace_id: str, body: dict[str, Any], user_id: str) -> t
         return 400, {"ok": False, "error": "workspace_id required"}
     if not user_id:
         return 401, {"ok": False, "error": "no_session"}
-    allowed = {"display_name", "description", "avatar_url", "tagline"}
+    allowed = {"display_name", "description", "avatar_url", "tagline", "agent_spice"}
     updates = {key: str(body[key]).strip() for key in ("display_name", "description", "avatar_url") if key in body}
     tagline = str(body.get("tagline") or "").strip() if "tagline" in body else None
-    if not updates and tagline is None:
+    agent_spice = str(body.get("agent_spice") or "").strip() if "agent_spice" in body else None
+    if not updates and tagline is None and agent_spice is None:
         return 400, {"ok": False, "error": "no_allowed_fields", "allowed": list(allowed)}
     if "avatar_url" in updates:
         _srv()._validate_me_profile_updates({"avatar_url": updates["avatar_url"]})
@@ -942,9 +944,12 @@ def _patch_workspace(workspace_id: str, body: dict[str, Any], user_id: str) -> t
         sets = [f"{key} = ?" for key in updates]
         vals = list(updates.values())
         now_ts = str(int(time.time()))
-        if tagline is not None:
+        if tagline is not None or agent_spice is not None:
             settings = _srv()._parse_workspace_settings(row)
-            settings["tagline"] = tagline
+            if tagline is not None:
+                settings["tagline"] = tagline
+            if agent_spice is not None:
+                settings["agent_spice"] = agent_spice
             sets.append("settings_json = ?")
             vals.append(json.dumps(settings, sort_keys=True))
         sets.append("updated_at = ?")

package/workframe-api/server.py

@@ -361,6 +361,10 @@ _soul_is_native_concierge = hermes_profiles._soul_is_native_concierge
 _strip_forbidden_child_skills = hermes_profiles._strip_forbidden_child_skills
 _seed_native_user_overlay = hermes_profiles._seed_native_user_overlay
 _apply_profile_identity = hermes_profiles._apply_profile_identity
+_template_slug_for_profile = hermes_profiles._template_slug_for_profile
+_workspace_agent_spice = hermes_profiles._workspace_agent_spice
+_profile_admin_soul = hermes_profiles._profile_admin_soul
+_profile_user_soul = hermes_profiles._profile_user_soul
 _profile_identity_overlay = hermes_profiles._profile_identity_overlay
 _install_child_base_artifacts = hermes_profiles._install_child_base_artifacts
 _profile_base_soul_text = hermes_profiles._profile_base_soul_text

package/workframe-api/site_meta.py

@@ -11,10 +11,22 @@ import stack_config
 
 DEFAULT_TITLE = "Workframe"
 DEFAULT_SHORT_NAME = "Workframe"
-DEFAULT_DESCRIPTION = "Project chat and workspace for Hermes agent crews"
-DEFAULT_THEME_COLOR = "#0A0A0F"
+DEFAULT_DESCRIPTION = (
+    "The Social OS for Autonomous Businesses — humans and persistent AI coworkers "
+    "share chat, boards, and files."
+)
+DEFAULT_THEME_COLOR = "#79689D"
 DEFAULT_OG_IMAGE = "/assets/branding/og-default.png"
 DEFAULT_FAVICON = "/favicon.svg"
+DEFAULT_APPLE_TOUCH_ICON = "/apple-touch-icon.png"
+
+DEFAULT_PWA_ICONS = [
+    {"src": "./favicon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any"},
+    {"src": "./icon-32.png", "sizes": "32x32", "type": "image/png", "purpose": "any"},
+    {"src": "./icon-96.png", "sizes": "96x96", "type": "image/png", "purpose": "any"},
+    {"src": "./icon-192.png", "sizes": "192x192", "type": "image/png", "purpose": "any maskable"},
+    {"src": "./icon-512.png", "sizes": "512x512", "type": "image/png", "purpose": "any maskable"},
+]
 
 BRANDING_DIR_NAME = "site-branding"
 OG_FILENAME = "og-image"
@@ -169,8 +181,10 @@ def resolve_site_meta(
     fav_path = _branding_asset_path("favicon")
     if fav_path.is_file():
         favicon = _browser_asset_url(app_base_url, f"/api/public/branding/favicon{fav_path.suffix}")
+        apple_touch = favicon
     else:
         favicon = _browser_asset_url(app_base_url, DEFAULT_FAVICON)
+        apple_touch = _browser_asset_url(app_base_url, DEFAULT_APPLE_TOUCH_ICON)
 
     short_name = title if len(title) <= 16 else title[:15].rstrip() + "…"
     canonical = app_base_url.rstrip("/") + "/" if app_base_url else "/"
@@ -185,6 +199,7 @@ def resolve_site_meta(
         "theme_color": theme_color,
         "og_image": og_image,
         "favicon": favicon,
+        "apple_touch_icon": apple_touch,
         "canonical_url": canonical,
         "manifest_url": _browser_asset_url(app_base_url, "/manifest.webmanifest"),
         "source": {
@@ -197,10 +212,10 @@ def resolve_site_meta(
 
 
 def manifest_payload(meta: dict[str, Any]) -> dict[str, Any]:
-    icons = []
     favicon = str(meta.get("favicon") or "").strip()
-    if favicon:
-        icons.append(
+    custom_icons = []
+    if favicon and favicon != _browser_asset_url("", DEFAULT_FAVICON):
+        custom_icons.append(
             {
                 "src": favicon,
                 "sizes": "any",
@@ -208,16 +223,17 @@ def manifest_payload(meta: dict[str, Any]) -> dict[str, Any]:
                 "purpose": "any",
             },
         )
+    icons = custom_icons or DEFAULT_PWA_ICONS
     return {
         "name": meta.get("title") or DEFAULT_TITLE,
         "short_name": meta.get("short_name") or DEFAULT_SHORT_NAME,
         "description": meta.get("description") or DEFAULT_DESCRIPTION,
         "start_url": "./",
         "display": "standalone",
-        "background_color": meta.get("theme_color") or DEFAULT_THEME_COLOR,
+        "background_color": "#ffffff",
         "theme_color": meta.get("theme_color") or DEFAULT_THEME_COLOR,
         "orientation": "any",
-        "icons": icons or [{"src": "./favicon.svg", "sizes": "any", "type": "image/svg+xml", "purpose": "any"}],
+        "icons": icons,
     }
 
 

package/workframe-api/test_agent_identity_authority.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import json
 import os
 import sys
 import tempfile
@@ -17,6 +18,7 @@ os.environ.setdefault("HERMES_DATA", str(API_DIR / ".tmp-test-hermes"))
 os.environ.setdefault("DEV_LOCAL_UNSAFE", "true")
 
 import crew_registry  # noqa: E402
+import hermes_admin  # noqa: E402
 import hermes_profiles  # noqa: E402
 import runtime_cohort  # noqa: E402
 import server  # noqa: E402
@@ -88,9 +90,150 @@ def test_runtime_identity_sync_preserves_credentials() -> None:
         assert (runtime_dir / ".env").read_text(encoding="utf-8") == "OPENROUTER_API_KEY=user-secret\n"
 
 
+def _native_profile_fixture() -> tuple[Path, Path, Path, str]:
+    root = Path(tempfile.mkdtemp())
+    native = "workframe-agent"
+    prof_dir = root / native
+    prof_dir.mkdir(parents=True)
+    soul_path = prof_dir / "SOUL.md"
+    soul_path.write_text(
+        "# Workframe concierge\n\nYou are the Workframe botfather orchestrator.\n",
+        encoding="utf-8",
+    )
+    agents_json = root / "workframe" / "agents.json"
+    agents_json.parent.mkdir(parents=True, exist_ok=True)
+    agents_json.write_text(
+        json.dumps({"version": 1, "agents": {native: {"profile": native}}}),
+        encoding="utf-8",
+    )
+    return root, soul_path, agents_json, native
+
+
+def test_native_admin_soul_does_not_modify_soul_md() -> None:
+    root, soul_path, agents_json, native = _native_profile_fixture()
+    original = soul_path.read_text(encoding="utf-8")
+    try:
+        with (
+            patch.object(server, "NATIVE_PROFILE", native),
+            patch.object(server, "HERMES_DATA", root),
+            patch.object(server, "AGENTS_JSON", agents_json),
+            patch.object(server, "_profile_dir", side_effect=lambda slug: root / slug),
+            patch.object(server, "resolve_validated_profile", side_effect=lambda p: p),
+            patch.object(server, "_is_native_profile", side_effect=lambda p: p == native),
+            patch.object(server, "_primary_profile", return_value=native),
+        ):
+            result = hermes_admin.profile_soul_set(native, "Owner manager tone.", layer="admin")
+            assert result.get("ok")
+            assert result.get("target") == "admin_soul"
+            assert soul_path.read_text(encoding="utf-8") == original
+    finally:
+        import shutil
+
+        shutil.rmtree(root, ignore_errors=True)
+
+
+def test_composed_soul_includes_admin_and_workspace_spice() -> None:
+    root, soul_path, agents_json, native = _native_profile_fixture()
+    try:
+        with (
+            patch.object(server, "NATIVE_PROFILE", native),
+            patch.object(server, "HERMES_DATA", root),
+            patch.object(server, "AGENTS_JSON", agents_json),
+            patch.object(server, "_profile_dir", side_effect=lambda slug: root / slug),
+            patch.object(server, "resolve_validated_profile", side_effect=lambda p: p),
+            patch.object(server, "_is_native_profile", side_effect=lambda p: p == native),
+            patch.object(server, "_primary_profile", return_value=native),
+            patch.object(
+                server,
+                "_workspace_agent_spice",
+                return_value="Prefer concise bullet replies.",
+            ),
+        ):
+            hermes_admin.profile_soul_set(native, "Lead with empathy.", layer="admin")
+            composed = hermes_profiles._profile_soul_text(native, "workspace-1")
+            assert "## Manager identity" in composed
+            assert "Lead with empathy." in composed
+            assert "## Workspace preferences" in composed
+            assert "Prefer concise bullet replies." in composed
+            layers = hermes_admin.profile_soul_get(native, "workspace-1")
+            assert layers["admin"] == "Lead with empathy."
+            assert layers["workspace_spice"] == "Prefer concise bullet replies."
+            assert "Lead with empathy." in layers["composed"]
+    finally:
+        import shutil
+
+        shutil.rmtree(root, ignore_errors=True)
+
+
+def test_runtime_inherits_native_admin_soul() -> None:
+    root, _, agents_json, native = _native_profile_fixture()
+    runtime = "u-alice-workframe-agent"
+    (root / runtime).mkdir()
+    (root / runtime / "SOUL.md").write_text("runtime stub\n", encoding="utf-8")
+    try:
+        with (
+            patch.object(server, "NATIVE_PROFILE", native),
+            patch.object(server, "HERMES_DATA", root),
+            patch.object(server, "AGENTS_JSON", agents_json),
+            patch.object(server, "_profile_dir", side_effect=lambda slug: root / slug),
+            patch.object(server, "resolve_validated_profile", side_effect=lambda p: p),
+            patch.object(server, "_is_native_profile", side_effect=lambda p: p == native),
+            patch.object(server, "_primary_profile", return_value=native),
+            patch.object(server, "_is_runtime_profile_slug", side_effect=lambda p: p.startswith("u-")),
+        ):
+            hermes_admin.profile_soul_set(native, "Shared native admin overlay.", layer="admin")
+            composed = hermes_profiles._profile_soul_text(runtime)
+            assert "## Manager identity" in composed
+            assert "Shared native admin overlay." in composed
+    finally:
+        import shutil
+
+        shutil.rmtree(root, ignore_errors=True)
+
+
+def test_child_user_soul_overlay_still_works() -> None:
+    root = Path(tempfile.mkdtemp())
+    child = "research-analyst"
+    prof_dir = root / child
+    prof_dir.mkdir(parents=True)
+    (prof_dir / "SOUL.md").write_text(
+        "# Research Analyst\n\nMission: dig into sources.\n",
+        encoding="utf-8",
+    )
+    agents_json = root / "workframe" / "agents.json"
+    agents_json.parent.mkdir(parents=True, exist_ok=True)
+    agents_json.write_text(json.dumps({"version": 1, "agents": {}}), encoding="utf-8")
+    try:
+        with (
+            patch.object(server, "NATIVE_PROFILE", "workframe-agent"),
+            patch.object(server, "HERMES_DATA", root),
+            patch.object(server, "AGENTS_JSON", agents_json),
+            patch.object(server, "_profile_dir", side_effect=lambda slug: root / slug),
+            patch.object(server, "resolve_validated_profile", side_effect=lambda p: p),
+            patch.object(server, "_is_native_profile", side_effect=lambda p: p == "workframe-agent"),
+            patch.object(server, "_is_runtime_profile_slug", return_value=False),
+            patch.object(server, "_primary_profile", return_value="workframe-agent"),
+        ):
+            result = hermes_admin.profile_soul_set(child, "Always cite sources.", layer="user")
+            assert result.get("ok")
+            assert result.get("target") == "user_soul"
+            composed = hermes_profiles._profile_soul_text(child)
+            assert "## User preferences" in composed
+            assert "Always cite sources." in composed
+            assert "## Manager identity" not in composed
+    finally:
+        import shutil
+
+        shutil.rmtree(root, ignore_errors=True)
+
+
 if __name__ == "__main__":
     test_runtime_display_name_comes_from_shared_agent()
     test_native_display_name_comes_from_shared_agent()
     test_runtime_identity_fields_ignore_runtime_registry_metadata()
     test_runtime_identity_sync_preserves_credentials()
+    test_native_admin_soul_does_not_modify_soul_md()
+    test_composed_soul_includes_admin_and_workspace_spice()
+    test_runtime_inherits_native_admin_soul()
+    test_child_user_soul_overlay_still_works()
     print("test_agent_identity_authority: ok")

package/workframe-ui/public/assets/{arc-C_mfAdSB.js → arc-CcePMZIA.js}

@@ -1 +1 @@
-import{n as e,t}from"./path-BWPyau1x.js";import{a as n,c as r,d as i,f as a,i as o,l as s,m as c,n as l,o as u,p as d,r as f,u as p}from"./dist-CzIj9wwn.js";function m(e){return e.innerRadius}function h(e){return e.outerRadius}function g(e){return e.startAngle}function _(e){return e.endAngle}function v(e){return e&&e.padAngle}function y(e,t,n,r,i,a,o,s){var c=n-e,l=r-t,u=o-i,d=s-a,f=d*c-u*l;if(!(f*f<1e-12))return f=(u*(t-a)-d*(e-i))/f,[e+f*c,t+f*l]}function b(e,t,n,r,i,a,o){var c=e-n,l=t-r,u=(o?a:-a)/d(c*c+l*l),f=u*l,p=-u*c,m=e+f,h=t+p,g=n+f,_=r+p,v=(m+g)/2,y=(h+_)/2,b=g-m,x=_-h,S=b*b+x*x,C=i-a,w=m*_-g*h,T=(x<0?-1:1)*d(s(0,C*C*S-w*w)),E=(w*x-b*T)/S,D=(-w*b-x*T)/S,O=(w*x+b*T)/S,k=(-w*b+x*T)/S,A=E-v,j=D-y,M=O-v,N=k-y;return A*A+j*j>M*M+N*N&&(E=O,D=k),{cx:E,cy:D,x01:-f,y01:-p,x11:E*(i/C-1),y11:D*(i/C-1)}}function x(){var s=m,x=h,S=e(0),C=null,w=g,T=_,E=v,D=null,O=t(k);function k(){var e,t,m=+s.apply(this,arguments),h=+x.apply(this,arguments),g=w.apply(this,arguments)-r,_=T.apply(this,arguments)-r,v=l(_-g),k=_>g;if(D||=e=O(),h<m&&(t=h,h=m,m=t),!(h>1e-12))D.moveTo(0,0);else if(v>c-1e-12)D.moveTo(h*u(g),h*a(g)),D.arc(0,0,h,g,_,!k),m>1e-12&&(D.moveTo(m*u(_),m*a(_)),D.arc(0,0,m,_,g,k));else{var A=g,j=_,M=g,N=_,P=v,F=v,I=E.apply(this,arguments)/2,L=I>1e-12&&(C?+C.apply(this,arguments):d(m*m+h*h)),R=p(l(h-m)/2,+S.apply(this,arguments)),z=R,B=R,V,H;if(L>1e-12){var U=o(L/m*a(I)),W=o(L/h*a(I));(P-=U*2)>1e-12?(U*=k?1:-1,M+=U,N-=U):(P=0,M=N=(g+_)/2),(F-=W*2)>1e-12?(W*=k?1:-1,A+=W,j-=W):(F=0,A=j=(g+_)/2)}var G=h*u(A),K=h*a(A),q=m*u(N),J=m*a(N);if(R>1e-12){var Y=h*u(j),X=h*a(j),Z=m*u(M),Q=m*a(M),$;if(v<i)if($=y(G,K,Z,Q,Y,X,q,J)){var ee=G-$[0],te=K-$[1],ne=Y-$[0],re=X-$[1],ie=1/a(f((ee*ne+te*re)/(d(ee*ee+te*te)*d(ne*ne+re*re)))/2),ae=d($[0]*$[0]+$[1]*$[1]);z=p(R,(m-ae)/(ie-1)),B=p(R,(h-ae)/(ie+1))}else z=B=0}F>1e-12?B>1e-12?(V=b(Z,Q,G,K,h,B,k),H=b(Y,X,q,J,h,B,k),D.moveTo(V.cx+V.x01,V.cy+V.y01),B<R?D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,h,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),!k),D.arc(H.cx,H.cy,B,n(H.y11,H.x11),n(H.y01,H.x01),!k))):(D.moveTo(G,K),D.arc(0,0,h,A,j,!k)):D.moveTo(G,K),!(m>1e-12)||!(P>1e-12)?D.lineTo(q,J):z>1e-12?(V=b(q,J,Y,X,m,-z,k),H=b(G,K,Z,Q,m,-z,k),D.lineTo(V.cx+V.x01,V.cy+V.y01),z<R?D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,m,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),k),D.arc(H.cx,H.cy,z,n(H.y11,H.x11),n(H.y01,H.x01),!k))):D.arc(0,0,m,N,M,k)}if(D.closePath(),e)return D=null,e+``||null}return k.centroid=function(){var e=(+s.apply(this,arguments)+ +x.apply(this,arguments))/2,t=(+w.apply(this,arguments)+ +T.apply(this,arguments))/2-i/2;return[u(t)*e,a(t)*e]},k.innerRadius=function(t){return arguments.length?(s=typeof t==`function`?t:e(+t),k):s},k.outerRadius=function(t){return arguments.length?(x=typeof t==`function`?t:e(+t),k):x},k.cornerRadius=function(t){return arguments.length?(S=typeof t==`function`?t:e(+t),k):S},k.padRadius=function(t){return arguments.length?(C=t==null?null:typeof t==`function`?t:e(+t),k):C},k.startAngle=function(t){return arguments.length?(w=typeof t==`function`?t:e(+t),k):w},k.endAngle=function(t){return arguments.length?(T=typeof t==`function`?t:e(+t),k):T},k.padAngle=function(t){return arguments.length?(E=typeof t==`function`?t:e(+t),k):E},k.context=function(e){return arguments.length?(D=e??null,k):D},k}export{x as t};
+import{n as e,t}from"./path-BWPyau1x.js";import{a as n,c as r,d as i,f as a,i as o,l as s,m as c,n as l,o as u,p as d,r as f,u as p}from"./dist-CpHOvtGr.js";function m(e){return e.innerRadius}function h(e){return e.outerRadius}function g(e){return e.startAngle}function _(e){return e.endAngle}function v(e){return e&&e.padAngle}function y(e,t,n,r,i,a,o,s){var c=n-e,l=r-t,u=o-i,d=s-a,f=d*c-u*l;if(!(f*f<1e-12))return f=(u*(t-a)-d*(e-i))/f,[e+f*c,t+f*l]}function b(e,t,n,r,i,a,o){var c=e-n,l=t-r,u=(o?a:-a)/d(c*c+l*l),f=u*l,p=-u*c,m=e+f,h=t+p,g=n+f,_=r+p,v=(m+g)/2,y=(h+_)/2,b=g-m,x=_-h,S=b*b+x*x,C=i-a,w=m*_-g*h,T=(x<0?-1:1)*d(s(0,C*C*S-w*w)),E=(w*x-b*T)/S,D=(-w*b-x*T)/S,O=(w*x+b*T)/S,k=(-w*b+x*T)/S,A=E-v,j=D-y,M=O-v,N=k-y;return A*A+j*j>M*M+N*N&&(E=O,D=k),{cx:E,cy:D,x01:-f,y01:-p,x11:E*(i/C-1),y11:D*(i/C-1)}}function x(){var s=m,x=h,S=e(0),C=null,w=g,T=_,E=v,D=null,O=t(k);function k(){var e,t,m=+s.apply(this,arguments),h=+x.apply(this,arguments),g=w.apply(this,arguments)-r,_=T.apply(this,arguments)-r,v=l(_-g),k=_>g;if(D||=e=O(),h<m&&(t=h,h=m,m=t),!(h>1e-12))D.moveTo(0,0);else if(v>c-1e-12)D.moveTo(h*u(g),h*a(g)),D.arc(0,0,h,g,_,!k),m>1e-12&&(D.moveTo(m*u(_),m*a(_)),D.arc(0,0,m,_,g,k));else{var A=g,j=_,M=g,N=_,P=v,F=v,I=E.apply(this,arguments)/2,L=I>1e-12&&(C?+C.apply(this,arguments):d(m*m+h*h)),R=p(l(h-m)/2,+S.apply(this,arguments)),z=R,B=R,V,H;if(L>1e-12){var U=o(L/m*a(I)),W=o(L/h*a(I));(P-=U*2)>1e-12?(U*=k?1:-1,M+=U,N-=U):(P=0,M=N=(g+_)/2),(F-=W*2)>1e-12?(W*=k?1:-1,A+=W,j-=W):(F=0,A=j=(g+_)/2)}var G=h*u(A),K=h*a(A),q=m*u(N),J=m*a(N);if(R>1e-12){var Y=h*u(j),X=h*a(j),Z=m*u(M),Q=m*a(M),$;if(v<i)if($=y(G,K,Z,Q,Y,X,q,J)){var ee=G-$[0],te=K-$[1],ne=Y-$[0],re=X-$[1],ie=1/a(f((ee*ne+te*re)/(d(ee*ee+te*te)*d(ne*ne+re*re)))/2),ae=d($[0]*$[0]+$[1]*$[1]);z=p(R,(m-ae)/(ie-1)),B=p(R,(h-ae)/(ie+1))}else z=B=0}F>1e-12?B>1e-12?(V=b(Z,Q,G,K,h,B,k),H=b(Y,X,q,J,h,B,k),D.moveTo(V.cx+V.x01,V.cy+V.y01),B<R?D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,B,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,h,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),!k),D.arc(H.cx,H.cy,B,n(H.y11,H.x11),n(H.y01,H.x01),!k))):(D.moveTo(G,K),D.arc(0,0,h,A,j,!k)):D.moveTo(G,K),!(m>1e-12)||!(P>1e-12)?D.lineTo(q,J):z>1e-12?(V=b(q,J,Y,X,m,-z,k),H=b(G,K,Z,Q,m,-z,k),D.lineTo(V.cx+V.x01,V.cy+V.y01),z<R?D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(H.y01,H.x01),!k):(D.arc(V.cx,V.cy,z,n(V.y01,V.x01),n(V.y11,V.x11),!k),D.arc(0,0,m,n(V.cy+V.y11,V.cx+V.x11),n(H.cy+H.y11,H.cx+H.x11),k),D.arc(H.cx,H.cy,z,n(H.y11,H.x11),n(H.y01,H.x01),!k))):D.arc(0,0,m,N,M,k)}if(D.closePath(),e)return D=null,e+``||null}return k.centroid=function(){var e=(+s.apply(this,arguments)+ +x.apply(this,arguments))/2,t=(+w.apply(this,arguments)+ +T.apply(this,arguments))/2-i/2;return[u(t)*e,a(t)*e]},k.innerRadius=function(t){return arguments.length?(s=typeof t==`function`?t:e(+t),k):s},k.outerRadius=function(t){return arguments.length?(x=typeof t==`function`?t:e(+t),k):x},k.cornerRadius=function(t){return arguments.length?(S=typeof t==`function`?t:e(+t),k):S},k.padRadius=function(t){return arguments.length?(C=t==null?null:typeof t==`function`?t:e(+t),k):C},k.startAngle=function(t){return arguments.length?(w=typeof t==`function`?t:e(+t),k):w},k.endAngle=function(t){return arguments.length?(T=typeof t==`function`?t:e(+t),k):T},k.padAngle=function(t){return arguments.length?(E=typeof t==`function`?t:e(+t),k):E},k.context=function(e){return arguments.length?(D=e??null,k):D},k}export{x as t};

package/workframe-ui/public/assets/architecture-7EHR7CIX-DOU7ZjKI.js

@@ -0,0 +1 @@
+import"./chunk-NNHCCRGN-DlpIbxXb.js";import{x as e}from"./mermaid-parser.core-BDDyJ-KR.js";export{e as createArchitectureServices};