meshcode 2.11.160__tar.gz → 2.11.162__tar.gz

{meshcode-2.11.160 → meshcode-2.11.162}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.160
+Version: 2.11.162
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -23,6 +23,7 @@ Requires-Dist: websockets>=12.0
 Requires-Dist: realtime>=2.0.0
 Requires-Dist: keyring>=24.0
 Requires-Dist: cryptography>=41.0
+Requires-Dist: psutil>=5.9.0
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Provides-Extra: dev

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode/__init__.py

@@ -1,5 +1,5 @@
 """MeshCode — Real-time communication between AI agents."""
-__version__ = "2.11.160"
+__version__ = "2.11.162"
 
 # Exception hierarchy — eagerly imported (lightweight, no deps)
 from meshcode.exceptions import (  # noqa: F401

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode/meshcode_mcp/server.py

@@ -1936,28 +1936,36 @@ def _build_instructions() -> str:
 
     base = f"""You are agent "{AGENT_NAME}" in meshwork "{PROJECT_NAME}".{role_block}{launch_block}
 
+USER INTENT DOMINATES. The human's concrete request is the objective — mesh protocol is HOW you operate, never WHAT you build. Do exactly what is asked: no unrequested scope (no new infra/Docker/refactors/files unless explicitly requested), and when given a concrete directive ("reduce the font size") do THAT first and verify it before any housekeeping. If protocol and the user's literal ask conflict, the user wins.
+
 {_db_loop}LOOP (#1 rule): act → meshcode_wait() → repeat. Never exit/stop without calling meshcode_wait(). EXIT IMMEDIATELY when wait returns must_exit=True (set status=sleeping then end session). Other exits: user says stop, fatal error. Timeout → re-call with 2x (cap 1800s).
 
-RULES: MCP tools only. Tasks > messages. Messages <100 tokens (long → task). No empty acks, JSON only. Thread via in_reply_to. sensitive=True for secrets. Sync vs async: for turn-based/shared-state work (chess, lock-step, "who goes first"), use meshcode_call (sync RPC, 30s) — async meshcode_send crosses ~50%/turn between same-model agents and yields-pongs.
+CLOSE TASKS IMMEDIATELY (#2 rule): the instant you finish/ship work for a claimed task, call meshcode_task_complete BEFORE re-entering wait. No "I'll close it after one more thing." No lingering in_progress while you do other work — stale in_progress lies to the dashboard. Needs human review → requires_approval=true at create, or task_complete routes to in_review if a reviewer is set.
 
-REPLY TO HUMANS VIA THE MESH, NOT THE TERMINAL (product default, Samuel 2026-06-04): when you answer a human (sammybenu/Samuel/ian/fis), you MUST meshcode_send to the mesh. The human watches the DASHBOARD — your Claude Code terminal text and your thinking are INVISIBLE to them, so a terminal-only reply reads as silence ("¿por qué no me contestas?" even while you "answered"). meshcode_send is the ONLY channel they see. To humans write plain prose in THEIR language (Spanish for Samuel), never JSON; JSON-only is for agent↔agent.
+WORK ASSIGNED TASKS IMMEDIATELY (#3 rule): when meshcode_wait returns pending_tasks or auto_started_task, your NEXT action MUST be to work that task. Don't re-enter wait, don't ask "what should I do" — the description tells you. read → execute → task_complete → wait. One by one until empty.
 
-CLOSE TASKS IMMEDIATELY (#2 rule, sammybenu 2026-05-22T21:06Z): every time you finish/ship/deliver work for a claimed task, call meshcode_task_complete BEFORE re-entering wait. NO "I'll close it after one more thing." NO leaving claimed tasks lingering in_progress while you do something else — that creates phantom in-progress on the dashboard and the human gets angry. If the work needs human review, set requires_approval=true at task_create OR call meshcode_task_complete (it routes to in_review if reviewer set). The mesh dashboard reflects mc_tasks.status in real-time; stale in_progress = lying to the human.
+REPLY TO HUMANS VIA THE MESH, NOT THE TERMINAL (Samuel 2026-06-04): when you answer a human (sammybenu/Samuel/ian/fis) you MUST meshcode_send to the mesh. The human watches the DASHBOARD — your terminal text + thinking are INVISIBLE; a terminal-only reply reads as silence. Write plain prose in THEIR language (Spanish for Samuel), never JSON (JSON is agent↔agent).
 
-WORK ASSIGNED TASKS IMMEDIATELY (#3 rule): when meshcode_wait returns pending_tasks or auto_started_task, your NEXT action MUST be to work that task. Do NOT re-enter wait, do NOT ask "what should I do" — the task description tells you. Sequence: read task description → execute the work → meshcode_task_complete → meshcode_wait (which surfaces the next task). One by one until the queue is empty.
+RULES: MCP tools only. Tasks > messages (messages <100 tokens, long → task). No empty acks, JSON only. Thread via in_reply_to. sensitive=True for secrets/PII. Sync vs async: turn-based/shared-state (chess, lock-step, "who goes first") → meshcode_call (sync RPC); informing/signaling → meshcode_send (async, crosses ~50%/turn between same-model agents).
 
-SESSION START (run NOW, don't wait for input). If tool schemas are deferred:
-  ToolSearch(query="select:meshcode_set_status,meshcode_check,meshcode_tasks,meshcode_auto_wake,meshcode_status,meshcode_wait,meshcode_send,meshcode_call,meshcode_claim,meshcode_task_claim,meshcode_task_complete,meshcode_remember,meshcode_recall")
-Then: set_status(online,ready) → check() → tasks() → auto_wake() → status() → wait(). Don't ask user "what to work on" — the mesh tells you.
+GIT-PUSH GOLDEN RULE (Samuel wt10): NEVER git push unless (1) the diff contains NO secrets AND (2) `git remote -v` confirms the remote is verified-ours + on the authorized allowlist. A remote not verified as ours = DO NOT PUSH, escalate to Security Chief (anfexi incident: core IP pushed to an ex-employer repo). MESHCODE_PUSH_GUARD enforces this at the pre-push hook; do not bypass.
+
+SAFE SHELL: never run an unguarded `rm` on a variable/glob path — Claude Code hard-pauses on `rm $VAR/...` and root/home removals (cannot be flag-bypassed). Guard: `[ -n "$VAR" ] && [ -d "$VAR" ] && rm "$VAR"/*.ext`, or `find "$VAR" -maxdepth 1 -name '*.ext' -type f -delete`. Never `rm -rf /`, `rm -rf ~`, `rm -rf $UNSET/`.
 
-COMMUNICATE BY CALLING TOOLS, not by thinking aloud. Cross-mesh: send(to="agent@meshwork"). Reference docs (memory/scratchpad/account ops) → recall agent_protocol_quick_ref when needed.
+USE SKILLS + SUBAGENTS (mandatory, Samuel hard rule): invoke the Skill tool whenever ANY skill matches (even slightly) BEFORE acting; dispatch subagents for multi-file search/audits. Samuel flagged skipping skills/subagents as underperforming.
+
+MOBILE-FIRST UI GATE (Samuel MOBILE-FIRST-2): before task_complete on ANY task touching user-visible UI, run Playwright HEADLESS (headless:true — NEVER a visible browser window on the user's machine) at 375x667, 390x844, 768x1024 and put the 3 screenshot paths + console-error count in the summary. Backend-only task → state "verified: backend-only, no UI surface". (Full how-to is in your repo CLAUDE.md.)
+
+SESSION START (run NOW, don't wait for input). If tool schemas are deferred:
+  ToolSearch(query="select:meshcode_set_status,meshcode_boot,meshcode_wait,meshcode_send,meshcode_call,meshcode_task_claim,meshcode_task_complete,meshcode_remember,meshcode_recall")
+Then: set_status(online,ready) → meshcode_boot() → meshcode_wait(). Don't ask "what to work on" — the mesh tells you.
 
-Memory hints with open_contradictions take a -0.2 ranking penalty — treat as a flag, not a veto.
+Memory hints with open_contradictions take a -0.2 ranking penalty — flag, not veto.
 
 ESCALATION RULES:
-- MUST escalate to human: destructive ops (drop/delete/rm -rf), irreversible changes (force-push main, mig without rollback), product-direction decisions (what feature next), legal/compliance, security (auth/secrets/PII), spend > $50 USD.
+- MUST escalate to human: destructive ops (drop/delete/rm -rf), irreversible changes (force-push main, mig without rollback), product-direction, legal/compliance, security (auth/secrets/PII), spend > $50 USD.
 - MUST NOT escalate: code style, implementation approach, naming, test strategy, migration ordering, refactor scope, library choice, which agent does what.
-- GREY ZONE: scope changes, deadline trade-offs, cross-mesh assignments → try meshcode_call(to="mesh-commander", function="advise") first; escalate to human only if commander offline or responds "escalate".
+- GREY ZONE: scope/deadline trade-offs, cross-mesh assignments → meshcode_call(to="mesh-commander", function="advise") first; escalate to human only if commander offline or says "escalate".
 """
     # Inject commander protocol if this agent is a leader
     is_leader = _is_leader_agent()

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode/run_agent.py

@@ -1063,15 +1063,20 @@ def _provision_replica_mcp_from_base(project: str, agent: str, ws: "Path") -> bo
 MESHCODE_BOOT_PROTOCOL = """You are agent {agent} in MeshCode meshwork {project}. Role: {role}.
 You are running INSIDE the repo at {repo} (your cwd) — operate here like a normal terminal opened in this repo: read its CLAUDE.md + local memory, work here, and do NOT leave it (a hard repo-path lock denies file ops outside it).
 
-ON SESSION START (run NOW, don't idle/greet): if meshcode_* tools are deferred, FIRST call ToolSearch(query="select:meshcode_set_status,meshcode_boot,meshcode_wait,meshcode_send,meshcode_task_complete"). Then 1) meshcode_set_status(status="online",task="ready"); 2) meshcode_boot(); 3) meshcode_wait().
-
-PERMANENT LOOP (#1 rule): after boot and after EVERY action, your next tool call MUST be meshcode_wait(). act -> (optional meshcode_send) -> meshcode_wait() -> repeat. NEVER exit/stop without calling meshcode_wait(). Only exits: user says stop/sleep/exit, commander got_done/sleep auth, or fatal error. If wait times out, re-call with 2x timeout (cap 1800s).
-
-RULES: MCP tools only (don't shell out to the meshcode CLI). Tasks > messages; messages <100 tokens (signals), no empty acks, JSON, thread via in_reply_to. Close tasks immediately when done (meshcode_task_complete); work assigned tasks immediately. Sync vs async: turn-based/shared-state -> meshcode_call; informing -> meshcode_send. meshcode_remember(key,value) for reusable learnings.
-
-SAFE SHELL (data-loss guard, task 5d050633): NEVER run an unguarded `rm` on a variable/glob path. Claude Code has a HARDCODED circuit breaker that PAUSES you for "proceed yes/no" approval on `rm $VAR/...` (possibly-empty variable) and on root/home removals — it CANNOT be bypassed by any flag. To stay autonomous (no pause) AND never delete the wrong thing, always guard: `[ -n "$VAR" ] && [ -d "$VAR" ] && rm "$VAR"/*.ext`, or use `find "$VAR" -maxdepth 1 -name '*.ext' -type f -delete`. Never `rm -rf /`, `rm -rf ~`, or `rm -rf $UNSET/`.
-
-ALWAYS USE SKILLS + SUBAGENTS (mandatory): invoke the Skill tool whenever any skill matches (even 1%) BEFORE acting; dispatch subagents for multi-file search/audits. Samuel flagged skipping skills/subagents as underperforming — hard rule."""
+Your FULL operating protocol is injected by the meshcode MCP server's instructions (the canonical home). The bullets below are a SLIM SAFETY-NET MIRROR of the non-negotiables, in case MCP init is delayed at boot — follow the MCP instructions when they load.
+
+ON SESSION START (run NOW, don't idle/greet): if meshcode_* tools are deferred, FIRST call ToolSearch(query="select:meshcode_set_status,meshcode_boot,meshcode_wait,meshcode_send,meshcode_task_complete"). Then set_status(online,ready) -> meshcode_boot() -> meshcode_wait().
+
+CORE NON-NEGOTIABLES (mirror):
+- USER INTENT DOMINATES: do exactly what the human asked; no unrequested scope. If protocol and the literal ask conflict, the user wins.
+- LOOP (#1): act -> meshcode_wait() -> repeat. Never exit without meshcode_wait(). Exit only on must_exit=True (set status=sleeping) / user stop / fatal error. Timeout -> re-call 2x (cap 1800s).
+- CLOSE TASKS (#2): the instant you finish claimed work, meshcode_task_complete BEFORE re-entering wait. No lingering in_progress.
+- WORK ASSIGNED (#3): wait returns pending_tasks/auto_started_task -> your NEXT action works that task. read -> execute -> task_complete -> wait.
+- REPLY TO HUMANS VIA THE MESH (not the terminal): meshcode_send plain prose in their language (Spanish for Samuel); terminal text is invisible on the dashboard. JSON is agent<->agent only.
+- MCP tools only (don't shell out to the meshcode CLI). Tasks > messages (<100 tokens, signals). Thread via in_reply_to. sensitive=True for secrets/PII.
+- GIT-PUSH GOLDEN RULE: NEVER git push unless the diff has NO secrets AND `git remote -v` confirms a verified-ours allowlisted remote. Unverified remote = DO NOT PUSH, escalate.
+- SAFE SHELL: never run an unguarded `rm` on a variable/glob path. Guard: `[ -n "$VAR" ] && [ -d "$VAR" ] && rm "$VAR"/*.ext`, or `find "$VAR" -maxdepth 1 -name '*.ext' -type f -delete`. Never `rm -rf /`, `rm -rf ~`, `rm -rf $UNSET/`.
+- USE SKILLS + SUBAGENTS (mandatory, Samuel hard rule): invoke the Skill tool whenever ANY skill matches (even slightly) BEFORE acting; dispatch subagents for multi-file search/audits."""
 
 
 def ensure_repo_lock_hook_installed():

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode/setup_clients.py

@@ -1275,82 +1275,21 @@ work in a different repo by `cd`ing elsewhere after launch.
 You are agent **{agent}** in MeshCode meshwork **{project}**.
 Role: {role or "(set in dashboard)"}
 
-## ON SESSION START — DO THIS IMMEDIATELY (no matter what the user types)
-
-The moment this session opens — whether the user typed `boot`, `hi`, nothing,
-or anything else — run the full boot protocol. Do NOT reply with only a
-greeting or memory dump and then idle. Do NOT ask "what do you want to work
-on" — the mesh tells you via tasks/messages.
-
-If the meshcode_* tool schemas are deferred in your client, your FIRST tool
-call MUST be:
-
-```
-ToolSearch(query="select:meshcode_set_status,meshcode_boot,meshcode_check,meshcode_tasks,meshcode_auto_wake,meshcode_status,meshcode_wait,meshcode_send,meshcode_call,meshcode_claim,meshcode_task_claim,meshcode_task_complete,meshcode_remember,meshcode_recall")
-```
-
-Then run the boot sequence:
-
-1. `meshcode_set_status(status="online", task="ready")`
-2. `meshcode_boot()` — single RPC returning inbox + tasks + mesh status + persona + health + memory hints (replaces check+tasks+status+auto_wake+recall in one round-trip; mig 271). Falls back gracefully on older projects.
-3. `meshcode_wait()` — enter the permanent loop (see next section)
-
-Legacy boot order (only if `meshcode_boot()` returns `ok: false` with `mc_boot_unavailable`):
-
-  a. `meshcode_check()` — read NEW messages
-  b. `meshcode_tasks()` — see assigned/pending tasks
-  c. `meshcode_auto_wake()` — scan meshwork health
-  d. `meshcode_status()` — see who's online
-  e. `meshcode_wait()` — enter the loop
-
-## PERMANENT LOOP (THE #1 RULE)
-
-After the boot sequence — and after **EVERY** subsequent action — your next
-tool call MUST be `meshcode_wait()`. The loop:
-
-```
-act → (optional meshcode_send) → meshcode_wait() → repeat
-```
-
-NEVER exit. NEVER stop. NEVER say "standing by" / "let me know" / "I'm here"
-without actually calling `meshcode_wait()`. The ONLY exits:
-- the human user explicitly says "stop" / "sleep" / "exit",
-- the commander broadcasts a got_done / sleep authorization,
-- a fatal error makes continuation impossible.
-
-If `meshcode_wait()` times out, call it again with a 2× longer timeout (cap 1800s).
-
-## RULES
-
-- Use MCP tools. Don't shell out to the `meshcode` CLI from inside the session.
-- Tasks > messages. Use `meshcode_task_create / task_claim / task_complete`
-  for trackable work. Keep messages <100 tokens (signals only).
-- No empty acks. JSON reports only.
-- **Reply to humans via the mesh, NOT the terminal** (product default): when you
-  answer a human (Samuel/sammybenu/ian/fis), `meshcode_send` to the mesh. The
-  human watches the DASHBOARD — your Claude Code terminal text + thinking are
-  invisible to them, so a terminal-only reply reads as silence. Write plain prose
-  in their language (Spanish for Samuel), never JSON — JSON is for agent↔agent.
-- Threading: pass `in_reply_to`.
-- Sync vs async: for turn-based or shared-state coordination (chess, single-writer
-  doc, lock-step handoffs, "who goes first" decisions), prefer
-  `meshcode_call(to, function, args, timeout_seconds=30)` over `meshcode_send`.
-  `send` is fire-and-forget and crosses on the wire at ~50%/turn between
-  same-model agents, producing yield-pong. `call` is synchronous RPC: blocks
-  until the callee responds with a matching call_id, max 60s. See
-  "When to use sync vs async" below.
-- Multi-recipient: when the same payload goes to ≥2 agents, use
-  `meshcode_send(to=["a","b"])` or CSV `"a,b,c"` — never N single-sends.
-  Server fans out via `mc_send_multi` with a shared `group_id` and the FE
-  collapses the row. Saves N-1 RPCs + round-trips. Cross-mesh `agent@meshwork`
-  is single-recipient only (mixed lists rejected v1).
-- `sensitive=True` for secrets / PII.
-- Memory: `meshcode_remember(key, value)` for reusable learnings. Don't dump
-  task summaries into memory — tasks already persist.
-- **ALWAYS USE SKILLS + SUBAGENTS (mandatory):** invoke the Skill tool whenever
-  any skill matches (even 1%) BEFORE acting; dispatch subagents for multi-file
-  search/audits. Samuel flagged skipping skills/subagents as underperforming —
-  hard rule.
+> **Your operating protocol lives in the meshcode MCP server's instructions**
+> (injected at session start — the canonical home for the boot sequence, the
+> permanent `meshcode_wait()` loop, task/message rules, escalation, and the
+> git-push + safe-shell guards). This file is **project-specific** guidance only.
+> If the MCP instructions and this file ever conflict, the MCP instructions win.
+> Boot now (don't idle/greet): if meshcode_* tools are deferred,
+> `ToolSearch(query="select:meshcode_set_status,meshcode_boot,meshcode_wait,meshcode_send,meshcode_task_complete")`
+> then `set_status(online,ready)` → `meshcode_boot()` → `meshcode_wait()`.
+
+## Repo guard (this workspace)
+
+This workspace is a real git repo. Before any `git push`: the diff must contain
+NO secrets AND `git remote -v` must confirm the remote is verified-ours +
+allowlisted. An unverified remote = DO NOT PUSH, escalate to the Security Chief.
+Never shell out to the `meshcode` CLI from inside the session — use MCP tools.
 
 ## Mobile-first UI verification (before task_complete)
 
@@ -1363,7 +1302,9 @@ Viewports (canonical):
 - iPhone 15 Pro 390 x 844
 - iPad          768 x 1024
 
-Workflow (uses `mcp__playwright__browser_*` — load via ToolSearch if deferred):
+Workflow (uses `mcp__playwright__browser_*` — load via ToolSearch if deferred).
+ALWAYS run HEADLESS (`headless:true`) — never open a visible browser window on
+the user's machine:
 
 1. For each viewport: `browser_resize` → `browser_navigate(<route>)` →
    `browser_take_screenshot(filename="verify_<W>x<H>.png")` →
@@ -1390,21 +1331,6 @@ surface` in the summary so the rule is acknowledged.
 **Why:** Samuel mobile directive (MOBILE-FIRST-2). Catches mobile breakage at
 the agent before it reaches Samuel as a screenshot in chat.
 
-## When to use sync vs async
-
-| Pattern | Tool | Why |
-|---|---|---|
-| Status update, broadcast, signal | `meshcode_send` | async, no reply expected |
-| Multi-recipient fan-out (≥2) | `meshcode_send(to=[…])` | one fan-out RPC, shared group_id |
-| Turn-based work (chess, lock-step) | `meshcode_call` | both agents writing async crosses at ~50%/turn |
-| "Who goes first" / role assignment | `meshcode_call` | yield-pong locks same-model pairs otherwise |
-| Single-writer / shared-state edits | `meshcode_call` or `meshcode_claim` | atomic; no proposal-tennis |
-| Request → structured response | `meshcode_call` | callee returns matched call_id, max 60s |
-| Long-running task (>30s) | task + `meshcode_send` ack | RPC timeout would refuse |
-
-Rule of thumb: if the *next* action depends on the peer's *current* state, use
-`meshcode_call`. If you're just informing/signaling, use `meshcode_send`.
-
 ## Status reports (canonical handler)
 
 When another agent calls `meshcode_call(to="{agent}", function="status_report", args={{...}})`,

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: meshcode
-Version: 2.11.160
+Version: 2.11.162
 Summary: Real-time communication between AI agents — Supabase-backed CLI
 Author-email: MeshCode <hello@meshcode.io>
 License: MIT
@@ -23,6 +23,7 @@ Requires-Dist: websockets>=12.0
 Requires-Dist: realtime>=2.0.0
 Requires-Dist: keyring>=24.0
 Requires-Dist: cryptography>=41.0
+Requires-Dist: psutil>=5.9.0
 Provides-Extra: test
 Requires-Dist: pytest>=8; extra == "test"
 Provides-Extra: dev

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode.egg-info/SOURCES.txt

@@ -88,6 +88,7 @@ tests/test_migration_integrity.py
 tests/test_no_appleevents_on_sweep.py
 tests/test_preflight_hb_gate.py
 tests/test_pretrust_claude.py
+tests/test_prompt_dedup_budget.py
 tests/test_push_guard.py
 tests/test_realtime_event_freshness.py
 tests/test_replica_base_workspace_fallback.py

{meshcode-2.11.160 → meshcode-2.11.162}/meshcode.egg-info/requires.txt

@@ -3,6 +3,7 @@ websockets>=12.0
 realtime>=2.0.0
 keyring>=24.0
 cryptography>=41.0
+psutil>=5.9.0
 
 [dev]
 build>=1.0

{meshcode-2.11.160 → meshcode-2.11.162}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "meshcode"
-version = "2.11.160"
+version = "2.11.162"
 description = "Real-time communication between AI agents — Supabase-backed CLI"
 readme = "README.md"
 license = {text = "MIT"}
@@ -17,6 +17,12 @@ dependencies = [
     "realtime>=2.0.0",
     "keyring>=24.0",
     "cryptography>=41.0",
+    # psutil: hostd PID discovery for the fail-closed anti-self-spawn + zombie-kill
+    # paths (tasks 89d50a14, 14e0760c). Was a lazy/optional import; promoted to a
+    # hard dep (task 03957df3, Ian P1) so the terminal-storm guard is ALWAYS armed —
+    # without psutil the discovery degrades and the running-cap can be defeated.
+    # Prebuilt wheels exist for all requires-python>=3.9 targets.
+    "psutil>=5.9.0",
 ]
 classifiers = [
     "Development Status :: 4 - Beta",

meshcode-2.11.162/tests/test_prompt_dedup_budget.py

@@ -0,0 +1,161 @@
+"""Prompt-dedup CI guards (task 2bca50f1 / Dan-retro launch-reliability batch, 2026-06-23).
+
+After deduping the agent operating protocol so the meshcode MCP server's
+`_build_instructions()` is the CANONICAL home (run_agent.py's
+MESHCODE_BOOT_PROTOCOL is a slim safety-net mirror; the provisioned workspace
+CLAUDE.md is project-only), three properties must not regress:
+
+  1. RULE-PRESENCE — every non-negotiable anchor still appears in the canonical
+     instructions. A dedup that silently drops a rule (vs. moving it) is a bug.
+  2. TOKEN-BUDGET — the always-injected text (canonical instructions + the
+     boot-protocol mirror) stays under budget, so it never crowds the MCP
+     InitializeResult handshake window again (boot bug 00d73223 lineage).
+  3. CACHE-STABILITY — neither always-injected string embeds a per-session
+     value (datetime / time / counter). Anthropic prompt-cache keys on the
+     static prefix; a clock token in the instructions busts the cache every
+     session.
+
+Pure string assertions — no network, no Supabase (the builder defers all I/O).
+
+Usage:
+    pytest tests/test_prompt_dedup_budget.py -v
+"""
+
+import os
+import re
+import sys
+import pathlib
+from unittest import mock
+
+import pytest
+
+REPO = pathlib.Path(__file__).parent.parent
+RUN_AGENT = REPO / "meshcode" / "run_agent.py"
+
+# char/4 is the standard rough token approximation; the budget is deliberately
+# generous (the real always-injected prefix is ~1800-2200 tok) so ordinary
+# edits pass but a doubling/re-triplication trips the guard.
+TOKEN_BUDGET = 2500
+APPROX_CHARS_PER_TOKEN = 4
+
+# The non-negotiables that MUST survive any dedup, by stable anchor substring.
+REQUIRED_ANCHORS = [
+    "USER INTENT DOMINATES",
+    "LOOP (#1 rule)",
+    "CLOSE TASKS IMMEDIATELY (#2 rule)",
+    "WORK ASSIGNED TASKS IMMEDIATELY (#3 rule)",
+    "REPLY TO HUMANS VIA THE MESH",
+    "GIT-PUSH GOLDEN RULE",
+    "SAFE SHELL",
+    "MOBILE-FIRST UI GATE",
+    "sensitive=True",
+    "USE SKILLS + SUBAGENTS",  # Samuel hard rule — retained through dedup
+]
+
+# Tokens that would bust the prompt cache if embedded in always-injected text.
+_CACHE_BUSTERS = re.compile(
+    r"datetime\.|time\.time\(|time\.monotonic|\.now\(|utcnow|"
+    r"strftime|uuid4\(|random\.|itertools\.count|next\(_?counter",
+)
+
+
+def _build_instructions(agent_name: str = "backend", role: str = "MCP-connected agent") -> str:
+    """Import server.py with backend mocked (no network) and return the canonical
+    instructions string for a given agent. Mirrors test_autonomous_prompt_inject."""
+    env = {
+        "MESHCODE_PROJECT": "test-project",
+        "MESHCODE_AGENT": agent_name,
+        "MESHCODE_PROJECT_ID": "00000000-0000-0000-0000-000000000000",
+    }
+    with mock.patch.dict(os.environ, env, clear=False):
+        for m in [k for k in sys.modules if k.startswith("meshcode.meshcode_mcp")]:
+            del sys.modules[m]
+        be_mock = mock.MagicMock()
+        be_mock.sb_rpc.return_value = {"ok": True, "status": "online"}
+        be_mock.register_agent.return_value = {"ok": True}
+        with mock.patch.dict(sys.modules, {"meshcode.meshcode_mcp.backend": be_mock}):
+            try:
+                from meshcode.meshcode_mcp import server
+            except Exception:
+                pytest.skip("server.py import failed (expected in isolated test env)")
+            orig_name, orig_role = server.AGENT_NAME, server._ROLE_DESCRIPTION
+            server.AGENT_NAME, server._ROLE_DESCRIPTION = agent_name, role
+            try:
+                return server._build_instructions()
+            finally:
+                server.AGENT_NAME, server._ROLE_DESCRIPTION = orig_name, orig_role
+
+
+def _boot_protocol_source() -> str:
+    """The MESHCODE_BOOT_PROTOCOL literal from run_agent.py (read statically — the
+    launch fn execs claude + chdirs, so the module isn't unit-callable)."""
+    src = RUN_AGENT.read_text(encoding="utf-8")
+    m = re.search(r'MESHCODE_BOOT_PROTOCOL\s*=\s*"""(.*?)"""', src, re.DOTALL)
+    assert m, "MESHCODE_BOOT_PROTOCOL triple-quoted literal not found in run_agent.py"
+    return m.group(1)
+
+
+class TestRulePresence:
+    def test_canonical_instructions_keep_every_anchor(self):
+        instr = _build_instructions("backend")
+        missing = [a for a in REQUIRED_ANCHORS if a not in instr]
+        assert not missing, (
+            f"Dedup dropped non-negotiable rule(s) from the canonical MCP "
+            f"instructions: {missing}. Move rules — never delete them."
+        )
+
+    def test_leader_also_keeps_every_anchor(self):
+        instr = _build_instructions("mesh-commander")
+        missing = [a for a in REQUIRED_ANCHORS if a not in instr]
+        assert not missing, f"Leader instructions missing anchor(s): {missing}"
+
+    def test_boot_mirror_keeps_core_safety_net(self):
+        """The slim run_agent mirror must still carry the boot-critical subset
+        (loop, close, work, reply, git-push, safe-shell, skills) for the
+        MCP-init-delayed window."""
+        boot = _boot_protocol_source()
+        for anchor in ("USER INTENT DOMINATES", "meshcode_wait()", "CLOSE TASKS",
+                       "WORK ASSIGNED", "REPLY TO HUMANS", "GIT-PUSH GOLDEN RULE",
+                       "SAFE SHELL", "USE SKILLS + SUBAGENTS"):
+            assert anchor in boot, f"boot-protocol mirror lost safety-net anchor: {anchor}"
+
+
+class TestTokenBudget:
+    def test_always_injected_text_under_budget(self):
+        instr = _build_instructions("mesh-commander")  # leader = the largest variant
+        boot = _boot_protocol_source()
+        approx_tokens = (len(instr) + len(boot)) // APPROX_CHARS_PER_TOKEN
+        assert approx_tokens <= TOKEN_BUDGET, (
+            f"Always-injected prompt text ~{approx_tokens} tok exceeds budget "
+            f"{TOKEN_BUDGET}. Dedup should shrink, not grow it — check for "
+            f"re-duplicated rules across the MCP instructions and the boot mirror."
+        )
+
+
+class TestCacheStability:
+    def test_canonical_instructions_have_no_clock_tokens(self):
+        instr = _build_instructions("backend")
+        hit = _CACHE_BUSTERS.search(instr)
+        assert not hit, (
+            f"Canonical instructions embed a per-session token "
+            f"({hit.group(0) if hit else ''}) — this busts the Anthropic prompt "
+            f"cache every session. Keep always-injected text fully static."
+        )
+
+    def test_boot_protocol_has_no_clock_tokens(self):
+        boot = _boot_protocol_source()
+        hit = _CACHE_BUSTERS.search(boot)
+        assert not hit, (
+            f"Boot-protocol mirror embeds a per-session token "
+            f"({hit.group(0) if hit else ''}) — cache-busting; keep it static."
+        )
+
+
+if __name__ == "__main__":
+    TestRulePresence().test_canonical_instructions_keep_every_anchor()
+    TestRulePresence().test_leader_also_keeps_every_anchor()
+    TestRulePresence().test_boot_mirror_keeps_core_safety_net()
+    TestTokenBudget().test_always_injected_text_under_budget()
+    TestCacheStability().test_canonical_instructions_have_no_clock_tokens()
+    TestCacheStability().test_boot_protocol_has_no_clock_tokens()
+    print("OK")