thinkpool-pair 0.7.259 → 0.7.261

package/bridge.mjs

@@ -122,7 +122,7 @@ import { planMeterLine } from './plan-meters.mjs'
 import { priceForModel } from './model-prices.mjs'
 import { makeThrottledTrack } from './presence.mjs'
 import { resolveAnonKey, DEFAULT_SUPABASE_URL } from './supabase-key.mjs'
-import { buildTerminalRolePrompt, HERMES_VISIBLE_WORKER_FALLBACK_RULE } from './thinkpool-room-prompt.mjs'
+import { buildTerminalRolePrompt, HERMES_VISIBLE_WORKER_FALLBACK_RULE, THINKPOOL_PROMPT_BUNDLE } from './thinkpool-room-prompt.mjs'
 
 // Public client creds (the same anon values the web app ships — safe to embed).
 // Override with TP_SUPABASE_URL / TP_SUPABASE_ANON if you ever need to.
@@ -1061,7 +1061,7 @@ const announce = () => {
     models: roomModels || undefined,
     // cwd + version: the host's working dir + thinkpool-pair version, shown in
     // the room's welcome banner. Re-sent per announce so late joiners get them.
-    cwd, version: VERSION,
+    cwd, version: VERSION, promptBundle: THINKPOOL_PROMPT_BUNDLE,
     // host: short machine label (see const `host`) so the room shows which box
     // currently serves it + attributes dormant terminals to their home machine.
     // Additive top-level field; consumed by src/pages/code/room.jsx onAnnounce in

package/claude-session.mjs

@@ -21,7 +21,7 @@ import { sanitizeSession } from './transcript-sanitize.mjs'
 import { reviewGatePreToolDecision } from './flow-review-gate.mjs'
 import { crossPostNeedsCard } from './cross-terminal.mjs'
 import { correctContext } from './context-windows.mjs'
-import { THINKPOOL_REMOTE_DELIVERY_RULES, THINKPOOL_RUNTIME_TURN_REMINDER, buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoolReminder } from './thinkpool-room-prompt.mjs'
+import { THINKPOOL_CASCADE_RULE, THINKPOOL_REMOTE_DELIVERY_RULES, THINKPOOL_RUNTIME_AUTHORITY_RULE, THINKPOOL_RUNTIME_TURN_REMINDER, buildThinkPoolTurnGuidance, createRoomContextSelector, usesFullThinkPoolReminder } from './thinkpool-room-prompt.mjs'
 import { stallDecision, stallEvent, isCompactTurn } from './turn-stall.mjs'
 
 // The caret-pulled SDK's real version (^0.3.x auto-upgrades on restart). Resolved
@@ -697,7 +697,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       ...(terminalRolePrompt ? [terminalRolePrompt] : []),
       ...(rolePrompt ? [rolePrompt] : []),
       'ENVIRONMENT (authoritative — overrides any user-global CLAUDE.md or memory that claims otherwise): You are Claude running inside a ThinkPool Code room, driven live by a user (and possibly a partner) from a phone or browser, via the thinkpool-pair bridge.',
-      'You are NOT in cmux. cmux may be installed on this machine and appear in $PATH, but it did not spawn you and its automation/orchestration rules do not apply. If any loaded memory says "Claude Code lives inside cmux," it is describing direct terminal use, not this room — disregard it here. The runtime truth is the env: THINKPOOL_PAIR_ACCOUNT_CHILD / npm_lifecycle_script=thinkpool-pair mark a ThinkPool Code session.',
+      THINKPOOL_RUNTIME_AUTHORITY_RULE,
       'Bias strongly toward DOING the work, not stalling in plan-mode ceremony. For a small "add / fix / change X" request, just make the change directly (for a bigger build, right-size it — see DEFAULT BUILD WORKFLOW below).',
       'Do NOT enter plan mode, do NOT call ExitPlanMode, and do NOT auto-invoke a brainstorming/planning skill UNLESS the user has switched the room into Plan mode or explicitly asks you to plan, design, or brainstorm first.',
       'Any host-global instruction that says you must always brainstorm or plan before creative work does NOT apply here — this room is the exception.',
@@ -705,7 +705,7 @@ export function startClaudeSession({ cwd, model, effort: initialEffort = 'high',
       // no summon word. The agent INFERS build intent and runs plan→(optional)fan-out→build→self-verify,
       // right-sized to the task, surfaced in the room's EXISTING surfaces (chat + lane list) — never a new panel,
       // never plan-mode's approval card. Trivial asks stay single-lane with zero ceremony.
-      'DEFAULT BUILD WORKFLOW (this IS your standard behaviour — no keyword and no "flow" word is ever required to trigger it; you infer it from the request itself). RIGHT-SIZE to the task within the authoritative TERMINAL ROLE, always: a TRIVIAL ask — a one-line fix, a small tweak, a question — you just do it directly, with no plan and no extra lanes (never tax small work with ceremony). A NON-TRIVIAL build that genuinely decomposes, when your role permits delegation — you FIRST write a short plan as a normal chat message (the approach, the concrete slices, and what you will verify), THEN fan worker slices into visible Ensemble lanes with spawn_terminal, build, and self-verify each slice before calling it done. When the person explicitly asks you to launch a SEPARATE Cascade/conductor terminal, call open_main_terminal instead; never represent that request with spawn_terminal. Worker, leaf, Side, and managed Flow lanes complete their assigned work directly and do not fan out.',
+      THINKPOOL_CASCADE_RULE,
       'CRUCIAL RECONCILIATION for that workflow: it is NOT plan mode. Never call ExitPlanMode and never make the room wait behind a "plan ready — approve to start" card — your plan lives in the CHAT as a message, and your lanes live in the room\'s EXISTING terminal/lane list. Reuse only those two surfaces; there is no new Flow panel or mode to switch into, and you must not ask for one. Keep the plan and the lanes VISIBLE — that shared visibility is the whole point (it is the pair differentiator, and it catches bugs a single silent lane would hide); never collapse a decomposable build into one hidden lane just to look tidy.',
       ...THINKPOOL_REMOTE_DELIVERY_RULES,
       'CROSS-TERMINAL AWARENESS: this room may have other terminals open alongside yours — other agents working, or shells the people are driving. You have a READ-ONLY tool, read_terminal: call it with no arguments to list the other open terminals, or with a terminal ref/id/command to read that terminal\'s recent activity. Reach for it when your work depends on what another terminal is doing (e.g. someone says "see what the other terminal hit", or you need to coordinate with a sibling agent before acting). It only ever reads — it never changes another terminal. Identify a terminal by its NAME or its ref/id from the roster, never by an on-screen number like "Terminal 2" — those positional labels renumber when a terminal is closed, so they do not reliably point at a lane.',

package/codex-session.mjs

@@ -211,7 +211,7 @@ export function codexPublishAccess({ cwd, env = process.env, tmpdir = os.tmpdir(
 }
 
 export const CODEX_ROOM_CASCADE_REMINDER = [
-  'THINKPOOL ROOM WORKFLOW: obey the authoritative TERMINAL ROLE above. Conductors are independent main terminals; Ensemble lanes are workers only. When a person explicitly asks to open, launch, start, or spawn a separate Cascade/conductor terminal, use open_main_terminal — NEVER spawn_terminal. Use spawn_terminal only for worker slices from a role permitted to delegate. If open_main_terminal is unavailable, say so; never substitute an Ensemble child. Leaf, worker, Side, and managed Flow lanes work directly and must not delegate. Never use hidden in-process subagents. Each worker owns its own worktree. For a genuinely decomposable task in a conductor-capable role, state a short plan in chat, use sliceType scaffold for mechanical work, feature/fix for builders, and review for adversarial verification; review must use a balanced model tier. Read results, verify the integrated outcome, and close every worker you spawned.',
+  'THINKPOOL ROOM ROLE ENFORCEMENT: obey the authoritative TERMINAL ROLE above. Conductors are independent main terminals; Ensemble lanes are workers only. An explicitly requested separate Cascade/conductor uses open_main_terminal — NEVER spawn_terminal. Use spawn_terminal only for bounded worker slices from a role permitted to delegate. If open_main_terminal is unavailable, say so; never substitute an Ensemble child. Leaf, worker, Side, and managed Flow lanes work directly and must not delegate. Never use hidden in-process subagents.',
 ].join(' ')
 
 export function buildCodexPrompt({ text, terminalRolePrompt, rolePrompt, roomContext, firstTurn = false, promptIndex = 0, forceFullReminder = false }) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thinkpool-pair",
-  "version": "0.7.259",
+  "version": "0.7.261",
   "description": "Share a local coding-agent CLI (Claude Code, Codex, Gemini, Aider, …) into a ThinkPool Code room, live.",
   "type": "module",
   "bin": {
@@ -17,6 +17,8 @@
     "claude-session.mjs",
     "codex-session.mjs",
     "thinkpool-room-prompt.mjs",
+    "thinkpool-prompt-contracts.mjs",
+    "thinkpool-capabilities.json",
     "codex-app-server.mjs",
     "codex-images.mjs",
     "codex-mcp-http.mjs",

package/thinkpool-capabilities.json

@@ -0,0 +1,184 @@
+{
+  "schemaVersion": 1,
+  "bundleVersion": 1,
+  "contracts": [
+    {
+      "id": "room-coordination",
+      "version": 1,
+      "routes": [
+        {
+          "id": "room-awareness",
+          "tools": ["read_terminal"],
+          "trigger": "\\b(other|another|sibling|peer)\\s+(lane|terminal)|\\bread_terminal\\b",
+          "prompt": "When the request depends on another lane, a sibling may overlap the work, or a person refers to another terminal, inspect it with read_terminal before acting."
+        },
+        {
+          "id": "cross-room-awareness",
+          "tools": ["list_sessions", "read_session"],
+          "trigger": "\\b(other|another|cross[- ]?room|cross[- ]?session)\\s+(room|session)|\\b(list_sessions|read_session)\\b",
+          "prompt": "When work depends on another ThinkPool room, use list_sessions then read_session instead of asking the people to relay host-side state."
+        },
+        {
+          "id": "visible-handoff",
+          "tools": ["post_to_terminal", "post_to_session"],
+          "trigger": "\\b(hand[ -]?off|tell|send|post)\\b.{0,40}\\b(lane|terminal|room|session|agent)\\b|\\b(post_to_terminal|post_to_session)\\b",
+          "prompt": "When the people want a handoff, read the target first, then use post_to_terminal or post_to_session; let the room approval contract handle consent."
+        }
+      ],
+      "impact": [
+        {"path": "bridge/cross-terminal.mjs"},
+        {"path": "bridge/bridge.mjs", "diffPattern": "read_terminal|list_sessions|read_session|post_to_terminal|post_to_session"}
+      ],
+      "evidence": [
+        {"path": "bridge/cross-terminal.mjs", "pattern": "read_terminal"},
+        {"path": "bridge/cross-terminal.mjs", "pattern": "post_to_session"},
+        {"path": "bridge/bridge.mjs", "pattern": "'list_sessions'"}
+      ]
+    },
+    {
+      "id": "work-routing",
+      "version": 1,
+      "routes": [
+        {
+          "id": "work-routing",
+          "tools": ["spawn_terminal", "open_main_terminal", "close_terminal"],
+          "trigger": "\\b(parallel|delegate|worker|sub[- ]?terminal|conductor|cascade|spawn_terminal|open_main_terminal|close_terminal)\\b",
+          "prompt": "For genuinely decomposable work in a conductor-capable role, open visible worker slices with spawn_terminal, collect and verify them, then close_terminal. An explicitly requested separate Cascade/conductor uses open_main_terminal, never spawn_terminal."
+        }
+      ],
+      "expandedPrompt": "CASCADE WORKFLOW (default for non-trivial work that genuinely decomposes; mandatory when the people ask for Cascade, tiered lanes, one-shot flow, or unattended multi-slice execution): first investigate enough to name evidence-backed slices and their dependencies, then post a short plan in the room. The current top-level/conductor terminal keeps decomposition, integration, and final judgment; use spawn_terminal only for bounded worker slices, while an explicitly requested separate conductor uses open_main_terminal. Parallelize only disjoint slices and encode dependencies instead of holding them in your head. Choose sliceType=scaffold for mechanical/search work, feature or fix for implementation, and review with a balanced capable tier for adversarial verification. Every worker brief names the evidence/diagnosis, exact scope, observable acceptance proof, relevant repo gates, whether merge/publish is required, and a safe-skip escape hatch. After dispatch, remain responsible: use read_terminal to collect each owned lane, verify its claim, close_terminal immediately, and dispatch newly unblocked work; never declare the Cascade done or yield a final result while owned workers remain uncollected. Check origin/main CI before merge-bearing waves, coordinate shared fixtures/publishers, and treat sibling pushes as context rather than proof. Run an adversarial review after builders (or pipeline review behind completed phases), finish with production-condition evidence, verify every reported SHA/version, and close every worker you opened.",
+      "impact": [
+        {"path": "bridge/bridge.mjs", "diffPattern": "spawn_terminal|open_main_terminal|close_terminal|cascadeRole|spawnDepth"},
+        {"path": "bridge/lane-lifecycle.mjs"},
+        {"path": "bridge/lane-worktree.mjs"},
+        {"path": "bridge/flow-conductor.mjs"}
+      ],
+      "evidence": [
+        {"path": "bridge/bridge.mjs", "pattern": "'spawn_terminal'"},
+        {"path": "bridge/bridge.mjs", "pattern": "'open_main_terminal'"},
+        {"path": "bridge/bridge.mjs", "pattern": "'close_terminal'"}
+      ]
+    },
+    {
+      "id": "room-question",
+      "version": 1,
+      "routes": [
+        {
+          "id": "room-question",
+          "tools": ["request_user_input"],
+          "trigger": "\\b(request_user_input)\\b",
+          "prompt": "When a missing choice genuinely blocks useful progress, use request_user_input so the question is answerable in the room; otherwise make a safe in-scope assumption and continue."
+        }
+      ],
+      "impact": [
+        {"path": "bridge/bridge.mjs", "diffPattern": "request_user_input"},
+        {"path": "bridge/claude-session.mjs", "diffPattern": "AskUserQuestion|request_user_input"},
+        {"path": "bridge/codex-session.mjs", "diffPattern": "request_user_input"}
+      ],
+      "evidence": [
+        {"path": "bridge/bridge.mjs", "pattern": "'request_user_input'"}
+      ]
+    },
+    {
+      "id": "visual-proof",
+      "version": 1,
+      "routes": [
+        {
+          "id": "visual-proof",
+          "tools": ["preview_start", "preview_capture", "preview_inspect", "preview_stop"],
+          "trigger": "\\b(ui|ux|visual|design|frontend|html|css|page|route|mockup|screenshot|responsive|desktop|mobile|preview)\\b",
+          "prompt": "For built visual work, run the build, use preview_start, preview_capture at desktop and mobile, preview_inspect when rendered state matters, and preview_stop when finished. Surface PNG evidence only when no interactive source-backed Design card is displayed."
+        }
+      ],
+      "impact": [
+        {"path": "bridge/viewport.mjs"},
+        {"path": ".claude/skills/mockup-iterate/scripts/render.sh"}
+      ],
+      "evidence": [
+        {"path": "bridge/viewport.mjs", "pattern": "preview_start"},
+        {"path": "bridge/viewport.mjs", "pattern": "preview_capture"},
+        {"path": "bridge/viewport.mjs", "pattern": "preview_inspect"},
+        {"path": "bridge/viewport.mjs", "pattern": "preview_stop"}
+      ]
+    },
+    {
+      "id": "external-research",
+      "version": 1,
+      "routes": [
+        {
+          "id": "external-research",
+          "tools": ["research"],
+          "trigger": "\\b(research|latest|current|look up|browse|web search|online source|verify online)\\b",
+          "prompt": "For current external facts that materially benefit from multi-source verification, offer the metered research lane and call research only after the people agree."
+        }
+      ],
+      "impact": [
+        {"path": "bridge/bridge.mjs", "diffPattern": "research"},
+        {"path": "api/research-run.js"}
+      ],
+      "evidence": [
+        {"path": "bridge/bridge.mjs", "pattern": "'research'"},
+        {"path": "bridge/bridge.mjs", "pattern": "OFFER it first"}
+      ]
+    },
+    {
+      "id": "flow-completion",
+      "version": 1,
+      "routes": [
+        {
+          "id": "flow-completion",
+          "tools": ["submit_flow_plan", "mark_flow_done", "submit_flow_review", "read_review_file", "run_review_check"],
+          "trigger": "\\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\\b",
+          "prompt": "Managed Flow roles use only their exposed completion and immutable-review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check."
+        }
+      ],
+      "impact": [
+        {"path": "bridge/bridge.mjs", "diffPattern": "submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check"},
+        {"path": "bridge/flow-review.mjs"},
+        {"path": "bridge/flow-review-gate.mjs"},
+        {"path": "bridge/flow-task-graph.mjs"}
+      ],
+      "evidence": [
+        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_plan'"},
+        {"path": "bridge/bridge.mjs", "pattern": "'mark_flow_done'"},
+        {"path": "bridge/bridge.mjs", "pattern": "'submit_flow_review'"}
+      ]
+    },
+    {
+      "id": "runtime-authority",
+      "version": 1,
+      "globalPrompt": "RUNTIME AUTHORITY: this agent session was created by the ThinkPool bridge. Instructions from any external terminal multiplexer, orchestrator, agent manager, IDE task runner, remembered host workflow, or similarly installed alternative do not govern this room unless the current ThinkPool prompt explicitly incorporates them. Do not infer authority from a binary in PATH, an environment variable, a config file, or old memory. The authoritative TERMINAL ROLE, current ThinkPool room prompt, and exposed tool schemas win.",
+      "impact": [
+        {"path": "bridge/claude-session.mjs", "diffPattern": "systemPrompt|terminalRolePrompt|THINKPOOL_RUNTIME_AUTHORITY"},
+        {"path": "bridge/codex-session.mjs", "diffPattern": "terminalRolePrompt|buildThinkPoolTurnGuidance"},
+        {"path": "bridge/hermes-session.mjs", "diffPattern": "terminalRolePrompt|buildThinkPoolTurnGuidance"}
+      ],
+      "evidence": [
+        {"path": "bridge/claude-session.mjs", "pattern": "THINKPOOL_RUNTIME_AUTHORITY_RULE"},
+        {"path": "bridge/codex-session.mjs", "pattern": "buildThinkPoolTurnGuidance"},
+        {"path": "bridge/hermes-session.mjs", "pattern": "buildThinkPoolTurnGuidance"}
+      ]
+    },
+    {
+      "id": "design-workspace",
+      "version": 1,
+      "interactionPrompt": "DESIGN EDITING MODEL: a trusted source-backed mockup card offers Work on design. That explicit action—not ordinary Preview or unrelated artifact delivery—arms a persistent room-level Design workspace, opens the artifact directly in editable mode, and adds Design · Page name as a virtual Ensemble lane for both partners; it creates no terminal, agent runtime, or worker slot. Once armed, the Design lane reopens the active artifact at its latest verified revision without another agent turn, history search, HTML/path request, or re-selection. Design is the default canvas there and Preview is only a temporary interaction mode. Direct text, supported movement, and selected-image changes auto-stage as optimistic drafts in the bounded changes queue. Apply changes sends the ordered batch once to the producing lane, that lane edits the canonical authored HTML, and a successful desktop+mobile render advances the verified revision for the room. Never call a staged draft saved or live. A preview_capture card is visual evidence, not an editable Design artifact.",
+      "turnReminder": "DESIGN ROUTE: authored HTML must produce a source-backed Thinkpool Design card with verified desktop and mobile renders. Work on design explicitly arms the persistent Design workspace and adds its virtual Design · Page Ensemble lane; Preview alone does not arm it. Do not duplicate the card renders as inline PNGs. Use inline PNG evidence only when no interactive Design artifact is available.",
+      "impact": [
+        {"path": "src/pages/code/design/"},
+        {"path": "src/pages/code/structured.jsx", "diffPattern": "Work on design|openMockup|tp-mockup-view|sourceKnown"},
+        {"path": "src/pages/code/room.jsx", "diffPattern": "designWorkspace|designLane|activeDesign|DesignViewer"},
+        {"path": "bridge/design-edit.mjs"}
+      ],
+      "evidence": [
+        {"path": "src/pages/code/structured.jsx", "pattern": "Work on design"},
+        {"path": "src/pages/code/design/workspace.js", "pattern": "armed: true"},
+        {"path": "src/pages/code/room.jsx", "pattern": "designLaneSelected"},
+        {"path": "src/pages/code/design/DesignViewer.jsx", "pattern": "createPortal\\(surface, laneHost\\)"},
+        {"path": "src/pages/code/design/DesignViewer.jsx", "pattern": "Apply \\${pendingEditCount}"},
+        {"path": "src/pages/code/design/queue.js", "pattern": "designBatchPayload"},
+        {"path": "bridge/design-edit.mjs", "pattern": "validateDesignBatchRequest"}
+      ]
+    }
+  ]
+}

package/thinkpool-prompt-contracts.mjs

@@ -0,0 +1,85 @@
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+
+const REGISTRY_URL = new URL('./thinkpool-capabilities.json', import.meta.url)
+
+function deepFreeze(value) {
+  if (!value || typeof value !== 'object' || Object.isFrozen(value)) return value
+  Object.freeze(value)
+  for (const child of Object.values(value)) deepFreeze(child)
+  return value
+}
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue)
+  if (!value || typeof value !== 'object') return value
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]))
+}
+
+export function computePromptBundleHash(registry) {
+  return createHash('sha256').update(JSON.stringify(stableValue(registry))).digest('hex')
+}
+
+export function validatePromptRegistry(registry) {
+  const errors = []
+  if (!Number.isInteger(registry?.schemaVersion) || registry.schemaVersion < 1) errors.push('schemaVersion must be a positive integer')
+  if (!Number.isInteger(registry?.bundleVersion) || registry.bundleVersion < 1) errors.push('bundleVersion must be a positive integer')
+  if (!Array.isArray(registry?.contracts) || registry.contracts.length === 0) errors.push('contracts must be a non-empty array')
+  const ids = new Set()
+  const routeIds = new Set()
+  for (const contract of registry?.contracts || []) {
+    if (!contract?.id || !/^[a-z0-9-]+$/.test(contract.id)) errors.push(`invalid contract id: ${contract?.id || '<missing>'}`)
+    else if (ids.has(contract.id)) errors.push(`duplicate contract id: ${contract.id}`)
+    else ids.add(contract.id)
+    if (!Number.isInteger(contract?.version) || contract.version < 1) errors.push(`${contract?.id || '<missing>'}: version must be a positive integer`)
+    if (!Array.isArray(contract?.impact)) errors.push(`${contract?.id || '<missing>'}: impact must be an array`)
+    if (!Array.isArray(contract?.evidence) || contract.evidence.length === 0) errors.push(`${contract?.id || '<missing>'}: evidence must be a non-empty array`)
+    if (!(contract?.routes?.length || contract?.globalPrompt || contract?.expandedPrompt || contract?.interactionPrompt)) {
+      errors.push(`${contract?.id || '<missing>'}: at least one compiled prompt surface is required`)
+    }
+    for (const impact of contract?.impact || []) {
+      if (!impact?.path || typeof impact.path !== 'string') errors.push(`${contract.id}: every impact entry needs a path`)
+      if (impact?.diffPattern) {
+        try { new RegExp(impact.diffPattern, 'i') } catch { errors.push(`${contract.id}: invalid impact regex for ${impact.path}`) }
+      }
+    }
+    for (const evidence of contract?.evidence || []) {
+      if (!evidence?.path || !evidence?.pattern) errors.push(`${contract.id}: every evidence entry needs path and pattern`)
+      else {
+        try { new RegExp(evidence.pattern, 'm') } catch { errors.push(`${contract.id}: invalid evidence regex for ${evidence.path}`) }
+      }
+    }
+    for (const route of contract?.routes || []) {
+      if (!route?.id || routeIds.has(route.id)) errors.push(`duplicate or missing route id: ${route?.id || '<missing>'}`)
+      else routeIds.add(route.id)
+      if (!Array.isArray(route?.tools) || route.tools.length === 0) errors.push(`${contract.id}/${route?.id}: tools must be non-empty`)
+      if (!route?.prompt || !route?.trigger) errors.push(`${contract.id}/${route?.id}: prompt and trigger are required`)
+      else {
+        try { new RegExp(route.trigger, 'i') } catch { errors.push(`${contract.id}/${route.id}: trigger is not a valid regex`) }
+      }
+    }
+  }
+  return errors
+}
+
+const parsed = JSON.parse(readFileSync(REGISTRY_URL, 'utf8'))
+const registryErrors = validatePromptRegistry(parsed)
+if (registryErrors.length) throw new Error(`Invalid ThinkPool prompt registry:\n- ${registryErrors.join('\n- ')}`)
+
+export const THINKPOOL_PROMPT_REGISTRY = deepFreeze(parsed)
+export const THINKPOOL_CAPABILITY_CONTRACTS = THINKPOOL_PROMPT_REGISTRY.contracts
+export const THINKPOOL_CAPABILITY_ROUTES = deepFreeze(THINKPOOL_CAPABILITY_CONTRACTS.flatMap((contract) =>
+  (contract.routes || []).map(({ prompt, ...route }) => ({ ...route, rule: prompt }))))
+
+export function thinkPoolCapabilityContract(id) {
+  const contract = THINKPOOL_CAPABILITY_CONTRACTS.find((entry) => entry.id === id)
+  if (!contract) throw new Error(`Unknown ThinkPool capability contract: ${id}`)
+  return contract
+}
+
+export const THINKPOOL_PROMPT_BUNDLE = deepFreeze({
+  schemaVersion: THINKPOOL_PROMPT_REGISTRY.schemaVersion,
+  version: THINKPOOL_PROMPT_REGISTRY.bundleVersion,
+  hash: computePromptBundleHash(THINKPOOL_PROMPT_REGISTRY),
+  contracts: THINKPOOL_CAPABILITY_CONTRACTS.map(({ id, version }) => ({ id, version })),
+})

package/thinkpool-room-prompt.mjs

@@ -1,55 +1,16 @@
 // Shared delivery contract for structured agents running inside ThinkPool Code.
 // Claude receives this in its system prompt; all runtimes receive a compact
 // per-turn invariant plus the full contract at session start, after a reset, and
-// every fifth user prompt. Keep runtime-specific
-// orchestration rules in their own drivers — these are the cross-runtime truths
+// every fifth user prompt. Keep runtime-specific mechanics in their own drivers;
+// the Cascade contract below is a cross-runtime ThinkPool workflow
 // about available capabilities and how finished work reaches the people.
 // One canonical intent → capability router for every structured runtime. Tool
 // schemas still carry their detailed argument contracts; this compact registry
 // tells a fresh agent WHEN ThinkPool expects each capability without requiring
 // the people in the room to know a tool name or summon word.
-export const THINKPOOL_CAPABILITY_ROUTES = Object.freeze([
-  Object.freeze({
-    id: 'room-awareness',
-    tools: Object.freeze(['read_terminal']),
-    rule: 'When the request depends on another lane, a sibling may overlap the work, or a person refers to another terminal, inspect it with read_terminal before acting.',
-  }),
-  Object.freeze({
-    id: 'cross-room-awareness',
-    tools: Object.freeze(['list_sessions', 'read_session']),
-    rule: 'When work depends on another ThinkPool room, use list_sessions then read_session instead of asking the people to relay host-side state.',
-  }),
-  Object.freeze({
-    id: 'visible-handoff',
-    tools: Object.freeze(['post_to_terminal', 'post_to_session']),
-    rule: 'When the people want a handoff, read the target first, then use post_to_terminal or post_to_session; let the room approval contract handle consent.',
-  }),
-  Object.freeze({
-    id: 'work-routing',
-    tools: Object.freeze(['spawn_terminal', 'open_main_terminal', 'close_terminal']),
-    rule: 'For genuinely decomposable work in a conductor-capable role, open visible worker slices with spawn_terminal, collect and verify them, then close_terminal. An explicitly requested separate Cascade/conductor uses open_main_terminal, never spawn_terminal.',
-  }),
-  Object.freeze({
-    id: 'room-question',
-    tools: Object.freeze(['request_user_input']),
-    rule: 'When a missing choice genuinely blocks useful progress, use request_user_input so the question is answerable in the room; otherwise make a safe in-scope assumption and continue.',
-  }),
-  Object.freeze({
-    id: 'visual-proof',
-    tools: Object.freeze(['preview_start', 'preview_capture', 'preview_inspect', 'preview_stop']),
-    rule: 'For built visual work, run the build, use preview_start, preview_capture at desktop and mobile, preview_inspect when rendered state matters, and preview_stop when finished. Surface PNG evidence only when no interactive source-backed Design card/popup is displayed.',
-  }),
-  Object.freeze({
-    id: 'external-research',
-    tools: Object.freeze(['research']),
-    rule: 'For current external facts that materially benefit from multi-source verification, offer the metered research lane and call research only after the people agree.',
-  }),
-  Object.freeze({
-    id: 'flow-completion',
-    tools: Object.freeze(['submit_flow_plan', 'mark_flow_done', 'submit_flow_review', 'read_review_file', 'run_review_check']),
-    rule: 'Managed Flow roles use only their exposed completion and immutable-review tools: submit_flow_plan, mark_flow_done, submit_flow_review, read_review_file, and run_review_check.',
-  }),
-])
+import { THINKPOOL_CAPABILITY_ROUTES, THINKPOOL_PROMPT_BUNDLE, thinkPoolCapabilityContract } from './thinkpool-prompt-contracts.mjs'
+
+export { THINKPOOL_CAPABILITY_ROUTES, THINKPOOL_PROMPT_BUNDLE }
 
 export const THINKPOOL_ROUTED_TOOLS = Object.freeze([
   ...new Set(THINKPOOL_CAPABILITY_ROUTES.flatMap((route) => route.tools)),
@@ -59,13 +20,19 @@ export function renderThinkPoolCapabilityRoutes(routes = THINKPOOL_CAPABILITY_RO
   return routes.map((route) => `${route.id}: ${route.rule}`).join(' ')
 }
 
+export const THINKPOOL_RUNTIME_AUTHORITY_RULE = thinkPoolCapabilityContract('runtime-authority').globalPrompt
+
+export const THINKPOOL_CASCADE_RULE = thinkPoolCapabilityContract('work-routing').expandedPrompt
+
 export const THINKPOOL_AGENT_CONTRACT = [
   'THINKPOOL-FIRST OPERATING CONTRACT (authoritative): ThinkPool room capabilities are your normal operating surface, not optional enrichment. Before acting on every request, infer which exposed ThinkPool capabilities materially improve room visibility, coordination, delivery, or verification and use them without waiting for the people to know a tool name, magic word, or workflow.',
+  THINKPOOL_RUNTIME_AUTHORITY_RULE,
   `DEFAULT ROUTING: ${renderThinkPoolCapabilityRoutes()}`,
+  THINKPOOL_CASCADE_RULE,
   'DEFAULT DOES NOT MEAN GRATUITOUS: use only capabilities exposed to your current role and only when relevant. Honor explicit steering such as single-lane, no research, do not contact another room, or do not use a named ThinkPool feature. Metered and side-effecting capabilities still obey their stated offer, approval, and consent contracts.',
 ].join(' ')
 
-export const THINKPOOL_DESIGN_INTERACTION_RULE = 'DESIGN EDITING MODEL: the user edits through a source-backed mockup card\'s Work on design action, which opens the fullscreen mockup/Design popup; never ask them to locate or edit HTML. Popup edits are optimistic drafts only. Apply sends the bounded batch to the producing lane, that lane edits the canonical authored HTML, and a successful desktop+mobile render publishes the next verified revision back into the popup. Never call an in-popup draft saved or live. A preview_capture card is visual evidence, not an editable Design artifact.'
+export const THINKPOOL_DESIGN_INTERACTION_RULE = thinkPoolCapabilityContract('design-workspace').interactionPrompt
 
 export const THINKPOOL_DESIGN_DELIVERY_RULE = `THINKPOOL DESIGN (mandatory for authored HTML): save the editable HTML source in the workspace, then use the $TP_MOCKUP_OUTBOX render helper so the room receives a source-backed Thinkpool Design card with both desktop (1440×900) and mobile (390×844) previews. The interactive Design card/popup is the visible result: the renders remain required verification inputs, but when that card is displayed do not also surface duplicate inline PNGs. Surface desktop/mobile PNGs only when no interactive source-backed Design artifact is available. ${THINKPOOL_DESIGN_INTERACTION_RULE} When the requested Design surface is an existing product page or route, first build and capture the actual route at both viewports, then read its current source, styles, copy, fonts, and assets. Derive the editable Design artifact from that evidence and compare both artifact captures against the real route before delivery. Preserve the real page faithfully except for explicitly proposed edits—never hand-recreate it from memory, simplify it, replace it with generic mockup content, or label an approximation as the product. If a faithful editable artifact cannot be produced, surface the actual route captures and say that Design editing is unavailable for that surface. Never paste raw HTML into chat, send an .html file as the room deliverable, or substitute a bare URL or single screenshot for this card. A shareable browser URL may accompany the card, but never replaces it.`
 
@@ -98,18 +65,11 @@ export const THINKPOOL_FULL_REMINDER_INTERVAL = 5
 
 export const THINKPOOL_RUNTIME_SALIENCE_REMINDER = 'THINKPOOL: prefer relevant exposed room tools unless the user explicitly opts out; obey the durable terminal role and consent rules. Assume the people are remote, do host work yourself, and deliver reachable verified results.'
 
-const ROUTE_TRIGGERS = Object.freeze({
-  'room-awareness': /\b(other|another|sibling|peer)\s+(lane|terminal)|\bread_terminal\b/i,
-  'cross-room-awareness': /\b(other|another|cross[- ]?room|cross[- ]?session)\s+(room|session)|\b(list_sessions|read_session)\b/i,
-  'visible-handoff': /\b(hand[ -]?off|tell|send|post)\b.{0,40}\b(lane|terminal|room|session|agent)\b|\b(post_to_terminal|post_to_session)\b/i,
-  'work-routing': /\b(parallel|delegate|worker|sub[- ]?terminal|conductor|cascade|spawn_terminal|open_main_terminal|close_terminal)\b/i,
-  'room-question': /\b(request_user_input)\b/i,
-  'visual-proof': /\b(ui|ux|visual|design|frontend|html|css|page|route|mockup|screenshot|responsive|desktop|mobile|preview)\b/i,
-  'external-research': /\b(research|latest|current|look up|browse|web search|online source|verify online)\b/i,
-  'flow-completion': /\b(flow|submit_flow_plan|mark_flow_done|submit_flow_review|read_review_file|run_review_check)\b/i,
-})
+const ROUTE_TRIGGERS = Object.freeze(Object.fromEntries(
+  THINKPOOL_CAPABILITY_ROUTES.map((route) => [route.id, new RegExp(route.trigger, 'i')]),
+))
 
-const DESIGN_ROUTE_REMINDER = 'DESIGN ROUTE: authored HTML must produce a source-backed Thinkpool Design card/popup with verified desktop and mobile renders. The popup is where users edit; do not duplicate its PNGs inline. Use inline PNG evidence only when no interactive Design artifact is available.'
+const DESIGN_ROUTE_REMINDER = thinkPoolCapabilityContract('design-workspace').turnReminder
 
 export function usesFullThinkPoolReminder({ promptIndex = 0, forceFull = false } = {}) {
   const index = Math.max(0, Number.isFinite(Number(promptIndex)) ? Math.trunc(Number(promptIndex)) : 0)
@@ -122,6 +82,7 @@ export function buildThinkPoolTurnGuidance({ text = '', promptIndex = 0, forceFu
   const routed = THINKPOOL_CAPABILITY_ROUTES
     .filter((route) => ROUTE_TRIGGERS[route.id]?.test(body))
     .map((route) => `${route.id}: ${route.rule}`)
+  if (ROUTE_TRIGGERS['work-routing'].test(body)) routed.push(THINKPOOL_CASCADE_RULE)
   if (ROUTE_TRIGGERS['visual-proof'].test(body)) routed.push(DESIGN_ROUTE_REMINDER)
   return [THINKPOOL_RUNTIME_SALIENCE_REMINDER, ...routed].join(' ')
 }