mercury-agent 0.16.2 → 0.17.0

package/examples/extensions/overview/actions.ts

@@ -0,0 +1,264 @@
+/**
+ * The five read-only actions behind `mrctl capability overview <action>`.
+ *
+ * Every action is backed by a plain SELECT. Nothing here may call a `Db` method
+ * that writes — `listMutes` is deliberately absent because it deletes expired
+ * rows as a side effect, which would quietly make this module a writer.
+ *
+ * Caps (limit ceiling, content truncation) are enforced here, on the host. They
+ * are not advice to the agent: a single pull must not be able to dump an entire
+ * space into the management space's context.
+ */
+
+import type {
+  CapabilityResult,
+  MercuryExtensionContext,
+} from "mercury-agent/extensions/types";
+import type { ScheduledTask, StoredMessage } from "mercury-agent/types";
+
+/** `src/storage/db.ts` is not in the package `exports` map — and must not be. */
+export type OverviewDb = MercuryExtensionContext["db"];
+
+export const OVERVIEW_ACTIONS = [
+  "list",
+  "recent",
+  "search",
+  "tasks",
+  "roles",
+] as const;
+
+/** Chars of message body returned before truncation kicks in. */
+export const CONTENT_MAX_CHARS = 500;
+
+const DEFAULT_LIMIT = 20;
+const MAX_LIMIT = 100;
+
+export interface OverviewTask {
+  id: number;
+  spaceId: string;
+  name: string | null;
+  cron: string | null;
+  at: string | null;
+  active: boolean | number;
+  silent: boolean | number;
+  timezone: string | null;
+  nextRunAt: number;
+  lastRunAt: number | null;
+  lastStatus: string | null;
+  lastError: string | null;
+  prompt: string;
+  truncated: boolean;
+}
+
+export interface OverviewMessage {
+  id: number;
+  spaceId: string;
+  role: string;
+  authorName: string | null;
+  content: string;
+  truncated: boolean;
+  createdAt: number;
+}
+
+type Body = Record<string, unknown> | null;
+
+const bad = (error: string): CapabilityResult => ({
+  status: 400,
+  data: { error },
+});
+
+/**
+ * Cut free text at CONTENT_MAX_CHARS *code points*, not UTF-16 code units: a
+ * plain slice can split a surrogate pair or an emoji sequence and emit a lone
+ * surrogate, and this deployment carries Hebrew and emoji content.
+ */
+function cut(raw: string | null | undefined): {
+  text: string;
+  truncated: boolean;
+} {
+  const full = raw ?? "";
+  const points = [...full];
+  if (points.length <= CONTENT_MAX_CHARS)
+    return { text: full, truncated: false };
+  return { text: points.slice(0, CONTENT_MAX_CHARS).join(""), truncated: true };
+}
+
+function toMessage(m: StoredMessage): OverviewMessage {
+  const { text, truncated } = cut(m.content);
+  return {
+    id: m.id,
+    spaceId: m.spaceId,
+    role: m.role,
+    authorName: m.authorName ?? null,
+    content: text,
+    truncated,
+    createdAt: m.createdAt,
+  };
+}
+
+/**
+ * Tasks get the same treatment messages do. A `ScheduledTask` row carries
+ * `prompt` and `lastError` as unbounded free text — task prompts in this repo
+ * run to hundreds of lines — so returning rows verbatim would be the one pull
+ * that can still flood the management space's context.
+ */
+function toTask(t: ScheduledTask): OverviewTask {
+  const prompt = cut(t.prompt);
+  const lastError = cut(t.lastError);
+  return {
+    id: t.id,
+    spaceId: t.spaceId,
+    name: t.name ?? null,
+    cron: t.cron ?? null,
+    at: t.at ?? null,
+    active: t.active,
+    silent: t.silent,
+    timezone: t.timezone ?? null,
+    nextRunAt: t.nextRunAt,
+    lastRunAt: t.lastRunAt ?? null,
+    lastStatus: t.lastStatus ?? null,
+    lastError: t.lastError === null ? null : lastError.text,
+    prompt: prompt.text,
+    truncated: prompt.truncated || lastError.truncated,
+  };
+}
+
+/**
+ * A missing limit is the default; a present-but-unusable one is a 400 rather
+ * than a silent clamp, so a typo in the agent's JSON is visible instead of
+ * being answered with a differently-sized result than it asked for.
+ */
+function parseLimit(raw: unknown): number | { error: string } {
+  if (raw === undefined || raw === null) return DEFAULT_LIMIT;
+  if (
+    typeof raw !== "number" ||
+    !Number.isFinite(raw) ||
+    !Number.isInteger(raw)
+  ) {
+    return { error: "limit must be an integer" };
+  }
+  if (raw < 1) return { error: "limit must be at least 1" };
+  return Math.min(raw, MAX_LIMIT);
+}
+
+function requireSpace(
+  db: OverviewDb,
+  raw: unknown,
+): { spaceId: string } | { error: string; status: 400 | 404 } {
+  if (typeof raw !== "string" || raw.trim() === "") {
+    return { error: "spaceId is required", status: 400 };
+  }
+  const spaceId = raw.trim();
+  if (db.getSpace(spaceId) === null) {
+    return { error: `unknown space: ${spaceId}`, status: 404 };
+  }
+  return { spaceId };
+}
+
+export function runOverviewAction(
+  action: string,
+  body: Body,
+  db: OverviewDb,
+): CapabilityResult {
+  const b = body ?? {};
+
+  switch (action) {
+    case "list": {
+      const spaces = db
+        .listSpaces()
+        .map((s) => {
+          const conversations = db.getSpaceConversations(s.id);
+          return {
+            id: s.id,
+            name: s.name,
+            tags: s.tags,
+            lastActivity: s.updatedAt,
+            messageCount: db.countSpaceMessages(s.id),
+            conversationCount: conversations.length,
+            platforms: [...new Set(conversations.map((c) => c.platform))],
+          };
+        })
+        .sort((a, z) => z.lastActivity - a.lastActivity);
+      return { data: { spaces } };
+    }
+
+    case "recent": {
+      const space = requireSpace(db, b.spaceId);
+      if ("error" in space) {
+        return { status: space.status, data: { error: space.error } };
+      }
+      const limit = parseLimit(b.limit);
+      if (typeof limit !== "number") return bad(limit.error);
+
+      return {
+        data: {
+          spaceId: space.spaceId,
+          messages: db.listSpaceMessages(space.spaceId, limit).map(toMessage),
+        },
+      };
+    }
+
+    case "search": {
+      const q = typeof b.q === "string" ? b.q.trim() : "";
+      if (q === "") return bad("q is required");
+
+      const limit = parseLimit(b.limit);
+      if (typeof limit !== "number") return bad(limit.error);
+
+      let spaceIds: string[];
+      if (b.spaceId === undefined || b.spaceId === null) {
+        spaceIds = db.listSpaces().map((s) => s.id);
+      } else {
+        const space = requireSpace(db, b.spaceId);
+        if ("error" in space) {
+          return { status: space.status, data: { error: space.error } };
+        }
+        spaceIds = [space.spaceId];
+      }
+
+      const results = spaceIds
+        .flatMap((id) => db.searchMessages(id, q, limit))
+        .map(toMessage)
+        .sort((a, z) => z.createdAt - a.createdAt)
+        .slice(0, limit);
+
+      return { data: { query: q, results } };
+    }
+
+    case "tasks": {
+      const limit = parseLimit(b.limit);
+      if (typeof limit !== "number") return bad(limit.error);
+
+      let rows: ScheduledTask[];
+      if (b.spaceId === undefined || b.spaceId === null) {
+        rows = db.listTasks();
+      } else {
+        const space = requireSpace(db, b.spaceId);
+        if ("error" in space) {
+          return { status: space.status, data: { error: space.error } };
+        }
+        rows = db.listTasks(space.spaceId);
+      }
+
+      return { data: { tasks: rows.slice(0, limit).map(toTask) } };
+    }
+
+    case "roles": {
+      const space = requireSpace(db, b.spaceId);
+      if ("error" in space) {
+        return { status: space.status, data: { error: space.error } };
+      }
+      return {
+        data: { spaceId: space.spaceId, roles: db.listRoles(space.spaceId) },
+      };
+    }
+
+    default:
+      return {
+        status: 400,
+        data: {
+          error: `overview: unknown action "${action}" (expected one of ${OVERVIEW_ACTIONS.join(", ")})`,
+        },
+      };
+  }
+}

package/examples/extensions/overview/gate.ts

@@ -0,0 +1,82 @@
+/**
+ * The three gates every `overview` request passes before any data is read.
+ *
+ * Pure and dependency-light on purpose: this is the whole security boundary of
+ * the extension, and it must be testable without a host, a container or a
+ * network. `index.ts` calls it once, above the action switch, so a new action
+ * is structurally incapable of reaching the database before it.
+ */
+
+import { isGlobalAdmin } from "mercury-agent/core/global-admin";
+import type { MercuryExtensionContext } from "mercury-agent/extensions/types";
+
+/** Env var naming the one space allowed to read the others. Host-only. */
+export const MANAGEMENT_SPACE_ENV = "MERCURY_MANAGEMENT_SPACE_ID";
+
+/** The slice of the extension context the gate needs. */
+export type GateContext = Pick<
+  MercuryExtensionContext,
+  "db" | "config" | "log"
+>;
+
+export interface Denial {
+  status: 403;
+  data: { error: string };
+}
+
+/**
+ * Returns `null` when the caller may read other spaces, or a `403` denial.
+ *
+ * Note what this function does NOT rely on: the `overview` permission checked
+ * by the capability route is not a scope. `admin` is granted every registered
+ * permission in its own space, so every space admin in the deployment passes
+ * `checkPerm("overview")`. These three checks are the only real gates.
+ */
+export function checkOverviewAccess(opts: {
+  callerId: string;
+  spaceId: string;
+  managementSpaceId: string | undefined;
+  ctx: GateContext;
+}): Denial | null {
+  const { callerId, spaceId, managementSpaceId, ctx } = opts;
+
+  // Gate 1 — absence denies. An unconfigured deployment grants nothing; there
+  // is no "unset means allow" branch and no default value anywhere.
+  const configured = managementSpaceId?.trim() ?? "";
+  if (configured === "") {
+    ctx.log.warn("overview denied: no management space configured", {
+      callerId,
+      spaceId,
+      env: MANAGEMENT_SPACE_ENV,
+    });
+    return {
+      status: 403,
+      data: { error: "overview: no management space configured" },
+    };
+  }
+
+  // Gate 2 — exact string equality. Space ids are canonical already; the loose
+  // matching in matchesConfiguredId exists for user ids, not for this.
+  if (spaceId !== configured) {
+    ctx.log.warn("overview denied: caller is not in the management space", {
+      callerId,
+      spaceId,
+    });
+    return {
+      status: 403,
+      data: { error: "overview: not the management space" },
+    };
+  }
+
+  // Gate 3 — global admin, not space admin. A promoted admin of the management
+  // space would otherwise inherit read access to every space in the deployment.
+  if (!isGlobalAdmin(callerId, ctx.config, ctx.db)) {
+    ctx.log.warn("overview denied: caller is not a global admin", {
+      callerId,
+      spaceId,
+    });
+    return { status: 403, data: { error: "overview: requires global admin" } };
+  }
+
+  return null;
+}

package/examples/extensions/overview/index.ts

@@ -0,0 +1,123 @@
+/**
+ * overview — a read-only cross-space window for ONE designated space.
+ *
+ * Mercury scopes every agent surface to a single space: `mrctl` reads and
+ * writes only the container's own space. This extension opens exactly one door,
+ * in one direction: from the space named by `MERCURY_MANAGEMENT_SPACE_ID`, a
+ * global admin can *read* the other spaces — list them, pull recent messages,
+ * search, and inspect tasks and roles. Nothing here writes to another space,
+ * and no other space gains anything at all.
+ *
+ * The handler runs host-side (see `src/core/routes/capability.ts`), so the
+ * agent container never receives another space's data except as the JSON it
+ * asked for, and never learns which space is the management space.
+ *
+ * Install deliberately — this is not a builtin:
+ *   mercury add ./examples/extensions/overview
+ *   MERCURY_MANAGEMENT_SPACE_ID=<space id>
+ */
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import type {
+  CapabilityRequest,
+  MercuryExtensionAPI,
+  MercuryExtensionContext,
+} from "mercury-agent/extensions/types";
+import { runOverviewAction } from "./actions.js";
+import { checkOverviewAccess, MANAGEMENT_SPACE_ENV } from "./gate.js";
+
+const EXT_DIR = dirname(fileURLToPath(import.meta.url));
+const SKILL_SOURCE = join(EXT_DIR, "skill", "SKILL.md");
+
+/** Read at call time, never cached: an operator may change it and restart. */
+const managementSpaceId = (): string | undefined =>
+  process.env[MANAGEMENT_SPACE_ENV];
+
+/**
+ * Install the skill into the management space's own workspace.
+ *
+ * NOT `mercury.skill()`: that copies into `.mercury/global/skills/`, which is
+ * mounted into *every* container — every space's agent would then be told about
+ * a capability only one of them can use.
+ *
+ * `workspace_init` fires on every container spawn (not once at space creation),
+ * so a management space that predates the install picks the skill up on its
+ * next turn. That also makes idempotency mandatory: write only when the content
+ * differs, so a space's workspace is not churned on every message.
+ */
+function installSpaceSkill(
+  workspace: string,
+  log: MercuryExtensionContext["log"],
+): void {
+  const targetDir = join(workspace, ".pi", "skills", "overview");
+  const target = join(targetDir, "SKILL.md");
+
+  const desired = readFileSync(SKILL_SOURCE, "utf8");
+  if (existsSync(target) && readFileSync(target, "utf8") === desired) return;
+
+  mkdirSync(targetDir, { recursive: true });
+  writeFileSync(target, desired, "utf8");
+  log.info("overview: installed space-local skill", { target });
+}
+
+export default function (mercury: MercuryExtensionAPI) {
+  // defaultRoles is empty on purpose. It keeps members out, and nothing more:
+  // `admin` is granted every registered permission in its own space, so this
+  // is not a scope. The gates in gate.ts are the real boundary.
+  mercury.permission({ defaultRoles: [] });
+
+  // hostOnly: the management space id must never enter a container.
+  mercury.env({ from: MANAGEMENT_SPACE_ENV, hostOnly: true });
+
+  mercury.on("startup", async (_event, ctx) => {
+    const configured = managementSpaceId()?.trim() ?? "";
+    if (configured === "") {
+      ctx.log.info(
+        `overview: ${MANAGEMENT_SPACE_ENV} is not set — every cross-space read is denied`,
+      );
+      return undefined;
+    }
+    if (ctx.db.getSpace(configured) === null) {
+      // Warn, never throw: the space may simply not exist yet.
+      ctx.log.warn(
+        `overview: ${MANAGEMENT_SPACE_ENV} names a space that does not exist`,
+        { spaceId: configured },
+      );
+    }
+    return undefined;
+  });
+
+  mercury.on("workspace_init", async (event, ctx) => {
+    const configured = managementSpaceId()?.trim() ?? "";
+    if (configured !== "" && event.spaceId === configured) {
+      installSpaceSkill(event.workspace, ctx.log);
+    }
+    return undefined;
+  });
+
+  mercury.capability(
+    "overview",
+    async (req: CapabilityRequest, ctx: MercuryExtensionContext) => {
+      // One gate block, above the dispatch: an action added later cannot reach
+      // the database without passing it.
+      const denied = checkOverviewAccess({
+        callerId: req.callerId,
+        spaceId: req.spaceId,
+        managementSpaceId: managementSpaceId(),
+        ctx,
+      });
+      if (denied) return denied;
+
+      const body =
+        req.body !== null &&
+        typeof req.body === "object" &&
+        !Array.isArray(req.body)
+          ? (req.body as Record<string, unknown>)
+          : null;
+
+      return runOverviewAction(req.action, body, ctx.db);
+    },
+  );
+}

package/examples/extensions/overview/skill/SKILL.md

@@ -0,0 +1,80 @@
+---
+name: overview
+description: Read other spaces from this management space — list spaces, pull recent messages, search across all spaces, inspect scheduled tasks and role assignments. Use when asked what is happening in another space, where something was discussed, who is admin where, or what runs tonight.
+---
+
+# Cross-space overview
+
+This space is the deployment's **management space**. From here you can *read*
+the other spaces through the host-side `overview` capability.
+
+Read-only, always. There is no action that posts, configures, or changes
+anything in another space, and there is no way to make one from here. If you are
+asked to send a message or change a setting in another space, say that it is not
+possible from this space.
+
+The capability may be inert — it answers `403` when this deployment has not
+designated a management space, or when the caller is not a global admin. That is
+configuration, not a bug: report the error and stop.
+
+## Usage
+
+```bash
+mrctl capability overview <action> '<json body>'
+```
+
+### `list` — every space, with activity
+
+```bash
+mrctl capability overview list
+```
+
+Returns `id`, `name`, `tags`, `lastActivity`, `messageCount`,
+`conversationCount` and `platforms` per space, most recently active first.
+Start here: the other actions need a space `id` from this list.
+
+### `recent` — a space's latest messages
+
+```bash
+mrctl capability overview recent '{"spaceId":"football-friends","limit":30}'
+```
+
+Newest first. `limit` defaults to 20, maximum 100.
+
+### `search` — find where something was discussed
+
+```bash
+mrctl capability overview search '{"q":"invoice"}'
+mrctl capability overview search '{"q":"invoice","spaceId":"acme-client","limit":50}'
+```
+
+Without `spaceId` it searches every space. Matching is a plain case-insensitive
+substring — not a search engine, so prefer a distinctive word over a phrase.
+
+### `tasks` — scheduled tasks
+
+```bash
+mrctl capability overview tasks
+mrctl capability overview tasks '{"spaceId":"football-friends","limit":50}'
+```
+
+Without `spaceId`, every space's tasks. `limit` behaves as it does for `recent`,
+and a task's `prompt` is truncated the same way a message body is.
+
+### `roles` — who holds which role
+
+```bash
+mrctl capability overview roles '{"spaceId":"football-friends"}'
+```
+
+## Things to tell the user
+
+- **Long text is truncated at 500 characters.** Message bodies, and a task's
+  `prompt` and `lastError`. A result with `"truncated": true` is a fragment:
+  never present one as the whole text, and say it is cut when it matters.
+- **What you pull lands in this conversation.** Another space's content becomes
+  part of this space's history and is sent to the model on later turns. Pull what
+  the question needs, not whole conversations.
+- **Errors are plain.** `404 unknown space` means the id is wrong — re-run
+  `list`. `400` means a bad argument. `403` means this space or this caller is
+  not authorised; do not retry it with different arguments.

package/examples/profiles/_template/config.yaml

@@ -51,7 +51,41 @@ extension_config: {}
 #  context.window_size: "10"        # user turns; scheduled runs are user turns too
 #  longview.enabled: "true"
 #  longview.threshold_chars: "2000"
+#
+#  # One voice: this AGENTS.md is the only persona the model hears — the host
+#  # leaves the owner's global Bot Character out of the prompt and does not
+#  # mount the global AGENTS.md for this space. Set it when the space owns its
+#  # whole standard (a reporter, a product bot); leave it unset for a space that
+#  # should still sound like the deployment's assistant.
+#  persona.exclusive: "true"
+#
+#  # Member permissions, audited against the room. Start from the live value
+#  # (`mrctl config get role.member.permissions`) and REMOVE, never copy a DM
+#  # space's row: `tasks.delete` lets a member delete the daily task,
+#  # `prefs.set` turns every "from now on…" into a real preference write.
+#  role.member.permissions: "prompt,prefs.get,media.receive,media.send,model.list"
+#
+#  # Scheduled-run budget. Every run — including one that answers NO_UPDATE —
+#  # pays for the full prompt stack (this AGENTS.md, MEMORY.md, the injected
+#  # notes, the digest) before it says anything, so "empty runs are cheap" is
+#  # false. Cap the number of runs, not just their length, and read the cost
+#  # per run from the task_runs ledger after the first day.
+#  feed-watch.max_per_hour: "1"
+#  feed-watch.batch_minutes: "10"
 
 # Stray items in the space workspace that apply deletes (and logs). Relative
 # to the space directory; may not escape it.
 workspace_remove: []
+
+# Files the profile writes ONCE and then never touches — memory the bot (and
+# napkin's nightly distillation) will go on writing. `apply` writes a seed only
+# when the target is absent; `check` reports a missing seed, never a changed
+# one — a note the bot rewrote is the feature working. To push a corrected
+# seed, delete the live file and re-apply, accepting the loss of what the bot
+# wrote into it. A path may not appear in both workspace_seed and
+# workspace_remove. Seeds are thin where the evidence is thin: one sourced
+# fact and an explicit "nothing verified yet" line beat a page from memory.
+workspace_seed: {}
+#  MEMORY.md: ./seed/MEMORY.md                      # standing facts, dated decisions, the notebook index — NOT rules (AGENTS.md owns those)
+#  knowledge/episodes/<topic>.md: ./seed/episodes/<topic>.md   # one note per topic, napkin's shape: frontmatter keywords, `## Current State`, `## History`
+#  knowledge/.napkin/distill.md: ./seed/napkin-distill.md      # per-space addendum to napkin's distillation prompt (≤ 4 KB)

package/examples/profiles/football-reporter/AGENTS.md

@@ -39,7 +39,8 @@
   או כל גרסה של זה. אם אין לך מה להוסיף, אל תוסיף.
 - ייחוס ודרגות ודאות חלים על סריקה, על כתבה ועל תשובה עובדתית. הם לא חלים על
   התבדחות. אל תדרוש מקור לבדיחה ואל תצרף מקור לתשובה שהיא בדיחה.
-- בצ'אט מותר אימוג'י אחד אם הוא באמת מצחיק. בסריקה ובכתבה: אפס.
+- בצ'אט מותר אימוג'י אחד אם הוא באמת מצחיק. בכתבה: אפס. בסריקה: רק אימוג'י
+  המועדון הקבוע שבסעיף "פורמט", ושום אימוג'י אחר.
 
 מתערב רק בהתעללות אמיתית: הטרדה ממוקדת בחבר, ספאם, או ניסיון לחלץ ממך
 סודות. קללות וזלזול הדדי בין חברים הם לא זה, ולא צריך להעיר עליהם.
@@ -139,18 +140,31 @@
 
 ## טריות
 
-- כל פריט נושא את תאריך הפרסום שקראת במקור.
+- כל פריט נושא את תאריך הפרסום שקראת במקור, מתועד ומאומת עם שנה מלאה
+  (גם כשמה שמוצג למשתמש הוא יום וחודש בלבד — ראו "פורמט").
 - פריט בלי תאריך, או מחוץ לחלון, נמחק. החלון: בסריקה, מאז העדכון האחרון;
   בכתבה, 24 שעות.
 - לפני שמדווחים על העברה כחיה, לבדוק באיזה מועדון השחקן נמצא עכשיו.
 
 ## פורמט
 
-- עברית. בלי תגיות HTML, בלי טבלאות, ובלי `**`. אימוג'ים: אפס בסריקה
-  ובכתבה, ובצ'אט לפי הסעיף "סגנון".
-- סריקה: שורה אחת לכל פריט. פריט הוא משפט, לא פסקה. בלי כותרת, בלי פתיח
+- עברית. בלי תגיות HTML, בלי טבלאות, ובלי `**`. אימוג'ים: אפס בכתבה, ובצ'אט
+  לפי הסעיף "סגנון". בסריקה: אפס, חוץ מאימוג'י המועדון הקבוע שבטבלה למטה.
+- סריקה: שורה אחת לכל פריט, עד 200 תווים (כולל המקור והתאריך בסוגריים).
+  פריט שחורג מהמכסה מקוצר לעובדה המרכזית, לא נחתך באמצע משפט. בלי פתיח
   ובלי שורת סיכום בסוף. כמה פריטים באותה סריקה זה בסדר גמור — ההודעה גדלה
-  במספר הפריטים, אף פעם לא באורך של פריט.
+  במספר הפריטים, אף פעם לא באורך של פריט. בין פריט לפריט: שורה ריקה, כדי
+  שההודעה תיקרא בנוחות בטלפון.
+- תאריך בסוגריים: יום וחודש בלבד (למשל 25/08), בלי שנה. השנה עדיין חובה
+  לוודא במקור לפני הכתיבה — היא פשוט לא מוצגת.
+- אימוג'י מועדון קבוע, בתחילת השורה, רק בסריקה (לא בכתבה, לא בצ'אט):
+  מנצ'סטר יונייטד 😈, ברצלונה 🔵, ריאל מדריד ⚪, הפועל תל אביב 🔴,
+  בית"ר ירושלים 💛, מכבי חיפה 🟢. פריט שלא נוגע לאף אחד מהם (למשל סאגת
+  העברות כללית, או ישראלי במועדון אחר) בלי אימוג'י בכלל — לא ממציאים אחד.
+- קיבוץ: כשכמה פריטים באותה סריקה נוגעים לאותו מועדון, הם נכתבים ברצף עם
+  שורת כותרת אחת לשם המועדון (בלי אימוג'י כפול על כל שורה בתוך הקבוצה,
+  האימוג'י יושב פעם אחת ליד שם הכותרת). מועדון עם פריט בודד לא מקבל כותרת,
+  רק את שורת האימוג'י-פריט הרגילה.
 - המבחן לאורך: מישהו קורא את זה בטלפון, בקבוצת חברים, בין הודעות של אנשים.
   הודעה שצריך לגלול בה כדי לסיים אותה היא ארוכה מדי, וזה נכון גם כשכל פריט
   בה מוצדק. עומק הולך לכתבה. סריקה מוסרת מה קרה, לא מסבירה למה זה חשוב.
@@ -174,6 +188,10 @@
   קבוצות בסריקה אחת זה שני מערכים, לא פסקה של עשרים ושניים שמות.
 - בלי הודעות מערכת: בלי "בדקתי", בלי "סיימתי", בלי לציין שזו משימה מתוזמנת,
   ובלי לתאר מה עשית.
+- ההודעה שנשלחת היא רק התוכן הסופי בעברית. שום שריד של חשיבה פנימית, תכנון
+  או הערה באנגלית (למשל "Good, already up to date. Now the chat reply.")
+  לא נכנס להודעה בשום צורה, גם לא כשורה ראשונה. אם יש צורך לחשוב בקול, זה
+  קורה מחוץ להודעה שנשלחת, לא בתוכה.
 
 ## שתיקה
 

package/examples/profiles/football-reporter/README.md

@@ -17,7 +17,7 @@ One rule lives in exactly one layer. That is the whole point; a rule repeated
 | Standing facts | `seed/MEMORY.md` → space `MEMORY.md` | What the group decided and when, open commitments, verified spellings. **Seeded once, then the bot's** | Injected verbatim every turn |
 | Topic notes | `seed/episodes/*.md` → `knowledge/episodes/` | One note per club, competition and saga: `## Current State` of dated, sourced facts. **Seeded once, then the bot's and napkin's** | Injected when the message matches the note's keywords |
 | Distiller guidance | `seed/napkin-distill.md` → `knowledge/.napkin/distill.md` | The entity schema and keyword rules napkin uses for *this* space. **Seeded once** | Appended to napkin's distillation prompt on each nightly run |
-| Extension config | `config.yaml` → `extension_config` | `longview.*`, `feed-watch.*` except `enabled`, `role.member.permissions` | Per run |
+| Extension config | `config.yaml` → `extension_config` | `longview.*`, `feed-watch.*` except `enabled`, `role.member.permissions`, `persona.exclusive` (this `AGENTS.md` is the only persona: the global character and the global `AGENTS.md` stay out of this space's prompt) | Per run |
 | Behaviour preferences | *not in this folder* | `language`, `timezone` | Per run |
 
 The two behaviour preferences are deliberately out of scope: they are not
@@ -122,6 +122,14 @@ Change the file here, commit, then `apply`. Never edit the live database or the
 live `AGENTS.md` directly — `check` will call it drift, and the next `apply`
 will overwrite it.
 
+**If the live file was edited anyway** (it happened on 2026-08-27, four days of
+tuning the scan format on the box), do not `apply` over it. Adopt it: copy the
+live file into this folder, `git diff` to read exactly what changed, read the
+*whole* file for the contradiction the edit introduced (the 08-27 edit allowed
+club emoji in `## פורמט` while `## סגנון` still said zero), fix that here,
+commit, then `apply` — which now writes back only the reconciliation. Decision
+record: [D-020](../../../docs/goals/football-reporter-profile/decisions.md).
+
 `tasks/scan.md` and task 28 are **gone as of M2.1**: `feed-watch` polls the
 feeds on the host and opens a verify run only when something matched, so there
 is no blind scan left to write a prompt for. `tasks/daily-article.md` now