polyrob 0.5.0__py3-none-any.whl

agents/task/agent/core/conversational_exit.py

@@ -0,0 +1,49 @@
+"""R1: conversational-exit policy for the agent run loop.
+
+Pure helpers so the policy is unit-testable without a live Agent. The run loop
+ends a turn when the agent keeps producing user-facing replies without calling
+done() — otherwise a greeting/chat answer loops and re-greets (the 2026-06-14
+Kimi anomaly). The rule is intentionally conservative:
+
+  * A turn ends only after ``CONVERSATIONAL_EXIT_AFTER_REPLIES`` *consecutive*
+    reply-only steps (no tool actually ran in any of them).
+  * Any productive step (a real tool result) OR a planning turn resets the
+    counter, so a task that does real work — even one that opens or closes with a
+    single standalone status message — is never cut short.
+  * Sub-agents never take this path; their turn boundary is owned by the parent.
+
+A *blocking* send_message and done() already end the turn via ``is_done`` and are
+not handled here (they are not tagged ``conversational_reply``).
+"""
+from __future__ import annotations
+
+from typing import Iterable
+
+# Number of back-to-back reply-only steps that ends a turn. 2 (not 1) leaves room
+# for a task to follow a leading status message with real work on the next step.
+CONVERSATIONAL_EXIT_AFTER_REPLIES = 2
+
+
+def is_reply_only_step(results: Iterable) -> bool:
+    """True if the step produced ≥1 result and EVERY result is a non-blocking
+    user-facing reply (tagged ``metadata.conversational_reply``) — i.e. no tool
+    actually executed this step.
+    """
+    results = list(results or [])
+    if not results:
+        return False
+    return all(bool(getattr(r, "metadata", None)) and r.metadata.get("conversational_reply") for r in results)
+
+
+def should_conversational_exit(consecutive_reply_steps: int, is_sub_agent: bool,
+                               is_autonomous: bool = False) -> bool:
+    """Whether the run loop should end the turn now (R1).
+
+    T2-08: an AUTONOMOUS session (goal/cron/planner-spawned) is exempt like a
+    sub-agent — there is no human chatting with it, so a run of status
+    send_messages is progress narration, not a greeting loop; cutting the turn
+    there ended missions mid-flight (and mislabeled the run's completion).
+    """
+    if is_sub_agent or is_autonomous:
+        return False
+    return consecutive_reply_steps >= CONVERSATIONAL_EXIT_AFTER_REPLIES

agents/task/agent/core/correspondent_gate.py

@@ -0,0 +1,227 @@
+"""WS-A capability gate — block high-impact tools while a session is "tainted" by
+untrusted correspondent DATA (Fusion HIGH/Q9).
+
+Correspondent replies enter as a user-role control message with prompt-level framing
+(`<correspondent-message>` + `<untrusted_tool_result>`). That framing is a SOFT defense:
+a strong injection could still try to drive a tool. This pre-tool-call hook is the
+STRUCTURAL backstop — while the latest input on a session is correspondent-untrusted,
+the dangerous tools (money, outbound messaging, code execution, delegation, browser)
+are denied, so a forged email can never directly spend/send/execute. The owner clears
+the taint simply by sending a genuine message (they are driving again).
+
+Pure policy + a hook factory; the taint flag lives on the orchestrator (set on
+correspondent injection, cleared on owner intake).
+
+⚠️ **tool_id vs action-name (the load-bearing detail).** The pre-tool-call hook receives
+the bare *action name* — ``run_code``, ``goal_create``, ``x402_fetch`` — never the
+*tool_id* (``code_execution``, ``goal``, ``x402_pay``). A denylist keyed on tool_ids is
+therefore dead: it only ever fires for a tool whose single action is literally named
+after the tool_id. So this module blocks in two layers:
+
+  1. ``_HIGH_IMPACT_NAMES`` — explicit high-impact *action* names (delegation, skill/
+     self-context, crypto trade verbs, git/github write verbs). Matched by name.
+  2. ``HIGH_IMPACT_TOOL_IDS`` — whole tools whose every non-read action is high-impact,
+     matched by RESOLVING the action's owning tool_id at hook time (via a resolver the
+     wiring passes in, backed by ``Controller.get_action_details(name).tool``). This is
+     the only way to cover dynamically-named actions such as MCP direct actions
+     (``{server}_{tool}`` → tool_id ``mcp``).
+
+Crypto tools (``hyperliquid``/``polymarket``) are deliberately EXCLUDED from
+``HIGH_IMPACT_TOOL_IDS`` so their read verbs (``get_*``) stay allowed — a tainted
+session may still answer "what's the price?"; their trade verbs are enumerated by name.
+"""
+from __future__ import annotations
+
+import logging
+from typing import Any, Callable, Optional
+
+logger = logging.getLogger(__name__)
+
+# ---------------------------------------------------------------------------
+# Layer 1 — high-impact *action* names (matched against the bare action name the
+# pre-hook receives). Includes standalone actions (registered directly, with no
+# owning container tool_id) plus enumerated verbs kept for defense-in-depth even
+# when tool-id resolution is unavailable. Crypto READ verbs are deliberately absent.
+# ---------------------------------------------------------------------------
+_HIGH_IMPACT_NAMES = frozenset({
+    # Delegation actions (registered directly, not container tools).
+    "delegate_task", "subtask", "parallel_subtasks",
+    # Identity / self-evolution actions (registered directly).
+    "skill_manage", "self_context_manage",
+    # Gated outbound message-to-target action (registered directly, no owning
+    # tool_id) — owner/allowlist-checked send to telegram/email/whatsapp.
+    "message",
+    # Aspirational coding/self-evolution action names (no tool yet; harmless tokens).
+    "self_modify", "mcp_install",
+    # WS-5: self_env self-maintenance verbs (posture 2). Owner-only via the posture
+    # gate already, but a tainted session must never reach them either.
+    "self_env_install_dep", "self_env_patch_source", "self_env_restart_service",
+    "self_env_git_pull", "self_env_read_source", "shell_run",
+    # WS-2/3: process job-manager verbs — enumerated by NAME (parity with shell_run)
+    # so a tool-id-resolver fault can't let a tainted session kill/inspect the owner's
+    # background shell jobs.
+    "process_kill", "process_log", "process_poll", "process_list",
+    # P1-4: code-exec verb enumerated by NAME (parity with shell_run) so a resolver
+    # fault can't open arbitrary code execution to a tainted session (the code_execution
+    # tool_id below only helps when resolution succeeds).
+    "run_code",
+    # P1-4: the agent money verb — x402_invoice tool, verb x402_request — mints a
+    # payment request. The canonical forged-email social-engineering target; must be
+    # unreachable while correspondent-tainted (x402_fetch/x402_pay already are).
+    "x402_request",
+    # P1-4: outbound-egress verbs whose query params are an exfil channel (parity with
+    # web_fetch/browser, which are already blocked). anysite/perplexity reach the
+    # outside world with attacker-influenced arguments.
+    "anysite_api", "perplexity_search",
+    # P1-4: curated-memory write persists into FUTURE sessions' prompts — a durable
+    # injection-persistence channel if written while tainted. Gate the whole action
+    # (read too) — fail-closed; the owner clears taint by replying.
+    "memory",
+    # Crypto trade verbs (hyperliquid + polymarket share these). Reads (get_*) are
+    # intentionally excluded so a tainted session can still fetch prices/history.
+    "place_limit_order", "place_market_order", "cancel_order", "cancel_all_orders",
+    "update_leverage", "approve_agent", "revoke_agent",
+    # git/github write verbs — also covered by tool-id resolution, kept here so a
+    # resolver fault can't open the money/ship-code path.
+    "git_push", "github_open_pr", "github_merge_pr", "github_pr_comment",
+    "github_issue_create",
+    # The auto-paying x402 action (the tool_id is x402_pay; the verb is x402_fetch).
+    "x402_fetch",
+    # Legacy tool_id tokens kept so is_high_impact(tool_id) stays truthy for callers/
+    # tests that probe by tool_id. Real per-verb coverage of these tools comes from
+    # HIGH_IMPACT_TOOL_IDS resolution below.
+    "code_execution", "coding", "cronjob", "goal", "x402_pay",
+    "hyperliquid", "polymarket", "email", "twitter", "browser", "web_fetch",
+    "git", "github", "process", "tool_manage", "mcp",
+    "x402_invoice", "anysite", "perplexity",  # P1-4 legacy tool_id tokens
+})
+
+# Back-compat public name (tests / other callers import HIGH_IMPACT_TOOLS).
+HIGH_IMPACT_TOOLS = _HIGH_IMPACT_NAMES
+
+# ---------------------------------------------------------------------------
+# Layer 2 — tool_ids whose EVERY action is high-impact, resolved at hook time from
+# the action name. Crypto is intentionally absent (its reads must stay allowed; its
+# trade verbs are in _HIGH_IMPACT_NAMES). Blocking a high-impact tool's read verbs
+# too (e.g. goal_list, cronjob_list, git_log) while tainted is the safe/fail-closed
+# direction — the owner clears the taint by replying.
+# ---------------------------------------------------------------------------
+HIGH_IMPACT_TOOL_IDS = frozenset({
+    "code_execution",  # run_code — arbitrary code exec
+    "coding",          # str_replace / apply_patch / run_tests / *_file — repo mutation
+    "cronjob",         # cronjob_schedule / cancel — durable recurring runs
+    "goal",            # goal_create / objective_* — durable autonomous work
+    "x402_pay",        # x402_fetch — auto-pay
+    "email",           # send_email — outbound comms
+    "twitter",         # twitter_post / reply / quote / thread — outbound comms
+    "browser",         # go_to_url / click_element / … — SSRF / exfil
+    "web_fetch",       # fetch_url — outbound fetch (SSRF / exfil)
+    "git",             # git_commit / clone / pull / push — ship code / identity
+    "github",          # github_open_pr / merge / … — ship code / identity
+    "mcp",             # execute_tool + dynamic {server}_{tool} — outbound / exec
+    "process",         # background processes (aspirational)
+    "tool_manage",     # dynamic-tool authoring (aspirational)
+    "shell",           # WS-2: persistent sandbox shell — arbitrary command exec
+    "self_env",        # WS-5: self-maintenance verbs — install/patch/restart/pull
+    # P1-4:
+    "x402_invoice",    # x402_request / accounting — mint agent payment requests (money)
+    "anysite",         # anysite_api — outbound structured-data egress (exfil channel)
+    "perplexity",      # perplexity_search — outbound search egress (exfil channel)
+})
+
+# Substrings that mark a high-impact action even if the exact name isn't enumerated
+# (e.g. provider-prefixed MCP/web tools that reach the outside world). NOTE: do NOT add
+# "trade" here — as a substring it falsely flags the read action get_trade_history while
+# matching no real trade verb (those are enumerated above).
+_HIGH_IMPACT_PREFIXES = ("mcp_", "browser_", "web_", "email_", "pay", "send_email")
+
+
+def is_high_impact(action_name: Optional[str]) -> bool:
+    """Name-only high-impact test (no tool_id resolution).
+
+    True if ``action_name`` is an enumerated high-impact action name (or legacy
+    tool_id token) or matches a high-impact substring. This is the backward-compatible
+    surface; the wired hook additionally resolves the owning tool_id via
+    :func:`is_high_impact_call`.
+    """
+    if not action_name:
+        return False
+    name = str(action_name).strip().lower()
+    if name in _HIGH_IMPACT_NAMES:
+        return True
+    return any(name.startswith(p) or p in name for p in _HIGH_IMPACT_PREFIXES)
+
+
+def is_high_impact_call(action_name: Optional[str], tool_id: Optional[str] = None) -> bool:
+    """Full high-impact decision for one action call.
+
+    Blocks when the bare action name is high-impact (:func:`is_high_impact`) OR when the
+    action's owning ``tool_id`` is in :data:`HIGH_IMPACT_TOOL_IDS`. ``tool_id`` is the
+    resolved owning tool (``Controller.get_action_details(name).tool``); pass ``None``
+    when it can't be resolved, in which case the decision degrades to the name-only path.
+    """
+    if is_high_impact(action_name):
+        return True
+    if tool_id and str(tool_id).strip().lower() in HIGH_IMPACT_TOOL_IDS:
+        return True
+    return False
+
+
+def build_tool_resolver(controller: Any) -> Callable[[str], Optional[str]]:
+    """Return ``action_name -> owning tool_id`` backed by a Controller.
+
+    Uses ``Controller.get_action_details(name).tool`` — the same registry seam the
+    untrusted-wrap uses to resolve an action's source tool. Never raises: a missing
+    controller, an unknown action, or a registry fault all degrade to ``None`` (the
+    caller then falls back to the name-only decision).
+    """
+    def _resolve(action_name: str) -> Optional[str]:
+        if controller is None:
+            return None
+        try:
+            details = controller.get_action_details(action_name)
+            return getattr(details, "tool", None) if details is not None else None
+        except Exception as e:
+            logger.debug("build_tool_resolver: get_action_details failed for %r: %s",
+                         action_name, e)
+            return None
+    return _resolve
+
+
+def make_correspondent_gate_hook(
+    get_tainted: Callable[[], bool],
+    resolve_tool: Optional[Callable[[str], Optional[str]]] = None,
+):
+    """Pre-tool-call hook ``(action_name, params, context) -> Optional[str]``.
+
+    Returns a denial reason (string) for a high-impact tool while the session is tainted
+    by untrusted correspondent data; None otherwise. Fail-CLOSED: if the taint probe
+    raises, a high-impact tool is denied (we can't prove the session is clean).
+
+    ``resolve_tool`` maps an action name to its owning tool_id so a tool_id-level
+    denylist (:data:`HIGH_IMPACT_TOOL_IDS`) actually fires — the pre-hook only ever sees
+    the bare action name. It is called defensively: a resolver fault degrades to the
+    name-only decision (never raises out of the hook, never silently opens a hole for a
+    name-level high-impact action).
+    """
+    def _hook(action_name: str, params: Any, context: Any) -> Optional[str]:
+        tool_id: Optional[str] = None
+        if resolve_tool is not None:
+            try:
+                tool_id = resolve_tool(action_name)
+            except Exception as e:  # resolution must never break the gate
+                logger.debug("correspondent gate tool resolve failed: %s", e)
+                tool_id = None
+        if not is_high_impact_call(action_name, tool_id):
+            return None
+        try:
+            tainted = bool(get_tainted())
+        except Exception as e:  # fail-closed: can't prove clean -> deny the dangerous tool
+            logger.debug("correspondent gate taint probe failed (deny): %s", e)
+            tainted = True
+        if tainted:
+            return (f"'{action_name}' is blocked: the latest input is untrusted "
+                    f"correspondent DATA — owner confirmation is required before a "
+                    f"high-impact action.")
+        return None
+    return _hook

agents/task/agent/core/curator.py

@@ -0,0 +1,246 @@
+"""Skill curator (W5, Reference-parity curator.py).
+
+Periodic maintenance of self-authored skills so the library doesn't rot: unused
+authored skills go stale, then archive (recoverable, never hard-deleted); reuse
+reactivates them. A skill the agent created but never reloads is noise — the curator
+is what keeps "writable skills" from becoming "write-only skills".
+
+Phase 1 (no LLM, always-on when CURATOR_ENABLED): ``apply_automatic_transitions``
+over ``created_by ∈ {agent, background_review}`` skills using the W2-D load_count:
+unused + age > ``CURATOR_STALE_DAYS`` → stale; stale + age > ``CURATOR_ARCHIVE_DAYS``
+→ archive (via SkillManager.delete_skill → ``.archived/``); reuse reactivates.
+System/pinned skills are never touched (only agent-authored ones).
+
+(A Phase-2 aux-LLM "merge near-duplicate skills into umbrellas" step was scaffolded
+but never had a real merge policy — it was a logged no-op. It was removed (2026-06-29
+dead-loop prune); re-add it under its own flag when a concrete merge policy exists.)
+
+Wired as a lifespan ticker (interval ``CURATOR_INTERVAL_HOURS``). Fail-open; a
+dry-run mode lets the first rollout observe transitions without applying them.
+"""
+from __future__ import annotations
+
+import logging
+import time
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+_AUTHORED = ["agent", "background_review"]
+_DAY_S = 86400.0
+
+
+class SkillCurator:
+    def __init__(self, skill_manager: Any, usage_store: Any, *,
+                 clock=time.time, dry_run: bool = False):
+        self.sm = skill_manager
+        self.usage = usage_store
+        self._now = clock
+        self.dry_run = dry_run
+
+    # --- Phase 1: automatic, no LLM -----------------------------------------
+
+    def apply_automatic_transitions(self) -> Dict[str, List[str]]:
+        """Stale/archive/reactivate authored skills by age + reuse. Returns the plan.
+
+        Pure-ish: computes the transition for every authored skill, then (unless
+        dry_run) applies archives via SkillManager. ``stale``/``reactivate`` are
+        bookkeeping states recorded in curator_state; ``archive`` is the only
+        filesystem effect (and it is recoverable).
+        """
+        from agents.task.constants import AutonomyConfig
+        stale_days = AutonomyConfig.curator_stale_days()
+        archive_days = AutonomyConfig.curator_archive_days()
+        now = self._now()
+        plan: Dict[str, List[str]] = {"stale": [], "archived": [], "reactivated": [], "kept": []}
+
+        rows = self.usage.list_authored(created_by=_AUTHORED)
+        for r in rows:
+            skill_id = r["skill_id"]
+            user_id = r["user_id"]
+            load_count = r.get("load_count", 0) or 0
+            created_at = r.get("created_at") or now
+            age_days = max(0.0, (now - created_at) / _DAY_S)
+            key = f"{user_id}/{skill_id}"
+
+            # SK-F2: a background-review-authored draft always lands in
+            # `.pending/` (quarantined, uncatalogued) — its load_count can
+            # NEVER rise because it isn't in rules.json to be loaded from.
+            # Age-based archiving would otherwise sweep up drafts nobody has
+            # reviewed yet. Resolve the actual file (active wins over pending
+            # if both somehow exist) and skip the row entirely while pending.
+            find_file = getattr(self.sm, "_find_skill_file", None)
+            if callable(find_file):
+                try:
+                    resolved = find_file(user_id, skill_id)
+                except Exception:
+                    resolved = None
+                if resolved is not None and ".pending" in Path(resolved).parts:
+                    continue  # pending = awaiting owner review, load_count can never rise
+
+            if load_count > 0:
+                # Reused → keep active; clear any prior stale mark.
+                if self._get_mark(key) == "stale":
+                    plan["reactivated"].append(key)
+                    if not self.dry_run:
+                        self._set_mark(key, "active")
+                        self._self_mod_ev("reactivate", skill_id, user_id)
+                else:
+                    plan["kept"].append(key)
+                continue
+
+            # never reused
+            # P2-21: skip a skill already archived on a prior tick. list_authored still
+            # returns its provenance row (rows persist after archive), so without this
+            # guard the weekly curator re-archived the same skill every tick — re-calling
+            # delete_skill (which returns False, file already gone) and re-emitting a
+            # self_modification "archive" event each time.
+            if self._get_mark(key) == "archived":
+                continue
+            if age_days > archive_days:
+                plan["archived"].append(key)
+                if not self.dry_run:
+                    try:
+                        self.sm.delete_skill(skill_id, user_id=user_id, absorbed_into=None)
+                        self._set_mark(key, "archived")
+                        self._self_mod_ev("archive", skill_id, user_id)
+                    except Exception as e:
+                        logger.debug("curator archive failed for %s: %s", key, e)
+            elif age_days > stale_days:
+                plan["stale"].append(key)
+                if not self.dry_run:
+                    self._set_mark(key, "stale")
+            else:
+                plan["kept"].append(key)
+
+        logger.info("curator phase-1: %s",
+                    {k: len(v) for k, v in plan.items()})
+        return plan
+
+    @staticmethod
+    def _self_mod_ev(action: str, skill_id: str, user_id: str) -> None:
+        """T4-06: curator lifecycle transitions are self-modifications too —
+        record them on the durable event log. Fail-open."""
+        try:
+            from agents.task.telemetry.self_events import emit_self_modification
+            emit_self_modification(kind="skill", action=action, item_id=skill_id,
+                                   user_id=user_id or "", created_by="curator",
+                                   source="curator")
+        except Exception as e:
+            logger.debug("curator event emit skipped: %s", e)
+
+    # --- state ---------------------------------------------------------------
+
+    def _get_mark(self, key: str) -> Optional[str]:
+        try:
+            return self.usage.get_state(f"curator:{key}")
+        except Exception:
+            return None
+
+    def _set_mark(self, key: str, value: str) -> None:
+        try:
+            self.usage.set_state(f"curator:{key}", value)
+        except Exception:
+            pass
+
+    def should_run(self) -> bool:
+        """Idle/interval gate: only run once per CURATOR_INTERVAL_HOURS."""
+        from agents.task.constants import AutonomyConfig
+        interval_s = AutonomyConfig.curator_interval_hours() * 3600.0
+        last = self.usage.get_state("curator:last_run")
+        if last is None:
+            return True
+        try:
+            return (self._now() - float(last)) >= interval_s
+        except (TypeError, ValueError):
+            return True
+
+    def mark_ran(self) -> None:
+        self._set_mark_raw("curator:last_run", str(self._now()))
+
+    def _set_mark_raw(self, key: str, value: str) -> None:
+        try:
+            self.usage.set_state(key, value)
+        except Exception:
+            pass
+
+    async def run_once(self) -> Dict[str, Any]:
+        """One curator pass: Phase 1 automatic transitions + episodic retention prune.
+        Fail-open.
+
+        (Stays ``async`` for the ticker contract even though Phase 1 is synchronous.)
+        """
+        result: Dict[str, Any] = {}
+        try:
+            result["transitions"] = self.apply_automatic_transitions()
+            self.mark_ran()
+        except Exception as e:
+            logger.error("curator run failed: %s", e, exc_info=True)
+            result["error"] = str(e)
+        self._prune_episodes()
+        return result
+
+    def _prune_episodes(self) -> None:
+        """Episodic activity-ledger retention sweep (Task 7), riding the curator's
+        own cadence — never the write path. Global sweep (all tenants); fail-open
+        so a memory-backend hiccup never breaks the curator tick."""
+        try:
+            from agents.task.constants import AutonomyConfig
+            from modules.memory.registry import get_memory_registry
+            prov = get_memory_registry().active()
+            if prov is not None and hasattr(prov, "prune_episodes"):
+                cutoff = int(self._now()) - AutonomyConfig.episodic_retention_days() * 86400
+                removed = prov.prune_episodes(older_than_ts=cutoff)
+                if removed:
+                    logger.info("curator: pruned %d old episodes", removed)
+        except Exception:
+            logger.warning("episodic prune skipped", exc_info=True)
+
+
+class CuratorTicker:
+    """Periodically run the curator (interval-gated). Mirrors CronTicker/GoalTicker."""
+
+    def __init__(self, curator: SkillCurator, *, check_interval_seconds: int = 3600,
+                 lock_path: Optional[str] = None):
+        self.curator = curator
+        self.check_interval_seconds = check_interval_seconds
+        self.lock_path = lock_path
+
+    async def run_forever(self, stop_event=None) -> None:
+        import asyncio
+        while not (stop_event is not None and stop_event.is_set()):
+            try:
+                if self.curator.should_run():
+                    lock = None
+                    if self.lock_path:
+                        from cron.scheduler import TickLock
+                        lock = TickLock(self.lock_path)
+                        if not lock.acquire():
+                            lock = None  # another worker holds the tick this cycle; skip
+                        else:
+                            try:
+                                await self.curator.run_once()
+                            finally:
+                                lock.release()
+                    else:
+                        await self.curator.run_once()
+            except Exception as e:
+                logger.error("curator tick failed: %s", e, exc_info=True)
+            try:
+                await asyncio.wait_for(
+                    stop_event.wait() if stop_event else asyncio.sleep(self.check_interval_seconds),
+                    timeout=self.check_interval_seconds,
+                )
+            except Exception:
+                pass
+
+
+def build_curator_ticker(*, data_dir: str = "data", dry_run: bool = False) -> CuratorTicker:
+    """Assemble the curator stack into a ticker the app lifespan can start/stop."""
+    import os
+    from agents.task.agent.skill_manager import get_skill_manager
+    from modules.skills.skill_usage import get_skill_usage_store
+    curator = SkillCurator(get_skill_manager(), get_skill_usage_store(data_dir), dry_run=dry_run)
+    return CuratorTicker(curator, lock_path=os.path.join(data_dir, "curator.tick.lock"))
+

agents/task/agent/core/episodic_digest.py

@@ -0,0 +1,103 @@
+"""Session-start activity digest (2026-07-03).
+
+Passive, read-only, pinned foundation message that puts the agent's OWN recent runs
+in front of it — so it can answer 'what did I run in the last 8h?' without a tool call.
+Scoped to owner/chat sessions ONLY (never goal/cron/sub-agent) to avoid a per-run token
+tax + distraction. Fail-open.
+
+NOTE on `kind not in ("chat",)`: goal/cron sessions are excluded by the CALLER (the
+first-step wiring in `memory_prefetch.py::MemoryPrefetchMixin._maybe_inject_episodic_digest`
+resolves `kind` via `agents.task.goals.autonomy_marker.is_autonomous(session_id)` and only
+ever passes `kind="chat"` here after confirming the session is not autonomous — see that
+module's docstring for why this can't be decided at Agent-construction time). This function
+re-checks `kind` itself so it is also safe to call directly (as the tests below do) with an
+explicit non-chat `kind`.
+"""
+from __future__ import annotations
+
+import logging
+import time
+from typing import Optional
+
+logger = logging.getLogger(__name__)
+
+
+async def build_activity_digest(*, user_id: Optional[str], kind: str,
+                                is_sub_agent: bool, window_hours: int = 24,
+                                limit: int = 10):
+    try:
+        from agents.task.constants import AutonomyConfig
+        if not AutonomyConfig.episodic_digest_inject():
+            return None
+        if is_sub_agent or kind not in ("chat",):        # owner/chat sessions only
+            return None
+        from modules.memory.registry import memory_recall_episodes
+        since_ts = int(time.time()) - window_hours * 3600
+        # exclude_surfaced=True: an episode already delivered out-of-band (cron
+        # email/telegram/twitter, or a goal self-wake) doesn't need to be
+        # re-surfaced here too — recent_activity() (explicit query) still sees
+        # everything regardless of the surfaced flag.
+        rows = await memory_recall_episodes(user_id=user_id, since_ts=since_ts,
+                                            limit=limit, order="newest",
+                                            exclude_surfaced=True)
+        if not rows:
+            return None
+        lines, total = [], 0.0
+        for e in rows:
+            total += float(e.spend_usd or 0)
+            lines.append(f"- {e.kind}:{e.outcome or '?'} ${float(e.spend_usd or 0):.2f} "
+                         f"\"{(e.task or '')[:60]}\"")
+        body = ("\n".join(lines)
+                + f"\n({len(rows)} runs in last {window_hours}h, ${total:.2f} total). "
+                  "Call recent_activity(since=\"8h\") for more/older.")
+        try:
+            from agents.task.agent.core.untrusted_wrap import wrap_untrusted
+            body = wrap_untrusted("recent_activity", body)
+        except Exception:
+            pass
+        from modules.llm.messages import make_control_message, MessageOrigin
+        return make_control_message(
+            f"<recent_activity window=\"last {window_hours}h\">\n{body}\n</recent_activity>",
+            MessageOrigin.EPISODIC_DIGEST)
+    except Exception:
+        logger.warning("build_activity_digest failed", exc_info=True)
+        return None
+
+
+async def build_mission_continuity(*, user_id: Optional[str], window_hours: int = 24,
+                                   limit: int = 8):
+    """Carry recent autonomous activity INTO the next goal/cron tick (§7.5).
+
+    Mirror-image of ``build_activity_digest``: this one is FOR autonomous sessions
+    (the caller confirms ``is_autonomous`` and never sub-agent), so a tick knows what
+    it already did/attempted and stops re-deriving 'nothing new' from scratch. Gated
+    ``AUTONOMOUS_CONTINUITY_BRIDGE`` (default OFF). Fail-open. Does NOT exclude
+    already-surfaced episodes — a tick genuinely needs to see everything it did.
+    """
+    try:
+        from agents.task.constants import AutonomyConfig
+        if not AutonomyConfig.autonomous_continuity_bridge():
+            return None
+        from modules.memory.registry import memory_recall_episodes
+        since_ts = int(time.time()) - window_hours * 3600
+        rows = await memory_recall_episodes(user_id=user_id, since_ts=since_ts,
+                                            limit=limit, order="newest")
+        if not rows:
+            return None
+        lines = [f"- {e.kind}:{e.outcome or '?'} \"{(e.task or '')[:70]}\"" for e in rows]
+        body = ("\n".join(lines)
+                + f"\n({len(rows)} recent runs in last {window_hours}h). "
+                  "Build on this — do NOT repeat work already done; if it's all covered, "
+                  "surface the blocker/next step rather than re-deriving 'nothing new'.")
+        try:
+            from agents.task.agent.core.untrusted_wrap import wrap_untrusted
+            body = wrap_untrusted("recent_activity", body)
+        except Exception:
+            pass
+        from modules.llm.messages import make_control_message, MessageOrigin
+        return make_control_message(
+            f"<mission_continuity window=\"last {window_hours}h\">\n{body}\n</mission_continuity>",
+            MessageOrigin.EPISODIC_DIGEST)
+    except Exception:
+        logger.warning("build_mission_continuity failed", exc_info=True)
+        return None