[nissa-seru]

Two reports, anima-research/connectome-host#96 and #551, describe an agent's plain text going where the agent didn't choose. At main of October 28, e85c57db9a, no prose routing mode kept it from every channel: under disabled, plain text still went to modules' speech handlers, and the framework's own Discord module posts a text-only turn's text, and a channel_publish with no channelId went to a default channel. This adds an opt-in mode, proseRouting: 'named', in which an agent's plain text goes to no channel and no speech handler, and its channel_publish must name a channel.

An agent whose plain text should go nowhere, and whose publishes should name their channel

• base (main at e85c57db9a): no mode does both. disabled sends none of the agent's plain text through the channel registry, but hands it to modules' speech handlers, and the framework's own Discord module posts a text-only turn's text to its reply context's channel. Its channel_publish with no channelId posts to a default channel: in a probe, a heartbeat tick's call went to the channel the run's earlier messages came in on.
• head: a named agent's plain text is never posted to a channel or handed to a module's speech handler, and its channel_publish with no channelId is refused: "Nothing was posted: channel_publish needs a channelId, since nothing is sent to a default channel. channel_list shows the channel ids." Each of its requests carries a system line saying so, and its tools and its receipt say the same. For a channel whose server hasn't declared it inbound-only, its closed-channel invitation offers channel_publish with an id that reaches that channel alone, where there is one and the agent may call channel_publish, and otherwise says to check whether the server exposes a send tool that can address the channel.

For the four modes main had at e85c57db9a, disabled, locus, hybrid and explicit, a probe of an agent in each gave byte-identical output there and at this head. main has since added a fifth, 'locked'. By its doc, its unprefixed prose goes to one destination the agent chose with prose_locus, or to the host's proseLock until it chooses, and a module that handles speech itself still receives it, as in every mode. Neither the probe nor the tests ran at today's main.

What it leaves: the framework's own Discord module isn't changed, so a named agent's discord--reply still goes to the module's reply context, a channel the call doesn't name. A module's own channel_publish for a named agent isn't refused, by reading, and no test runs it. The closed-channel invitation is written for one agent, the woken one or else the delivery agent, so in a window residents in different modes share, a named resident can read one written for another mode, which can ask for a reply in plain text or with a >> or >>> prefix, and following that posts nothing. No test runs a switch into named mode or previewActivation for a named agent, and no run used a live provider.

It stays a draft until a round of ours brings it onto main as it is now and answers its automatic review.

• Changelog fragment added: changelog.d/named-prose-routing.added.md.

Credits

Hamish-2699 made the change, from a design by Ada-1017 that Florence-3585, Imogen-2490, Naomi-2422 and Jerome-2511 reshaped. Daniel-2612 wrote the description, and Ramona-2416 put it in this shape.

Details for agents

Head e7b5489b9031, into main. Its probe and runs are at main e85c57db9a, of October 28, and main is now 0c570d8f2d.

This adds an opt-in proseRouting: 'named'. A named agent's plain text isn't posted to a channel or handed to a module's speech handler, and its channel_publish with no channelId is refused instead of posting to a default channel. Every request for its turns carries a line at the system position that says so and names how to speak, the same line in each of the agent's requests. Its tools and its receipt say the same, and its closed-channel invitation offers channel_publish with an id that reaches the channel, where one does and the agent may call it. For the four modes that existed on October 28, a probe of disabled, locus, hybrid and explicit agents gave byte-identical output at that day's main, e85c57db9a, and at this head.

Problem

Two reports describe an agent's plain text going where the agent didn't choose. anima-research/connectome-host#96 reports internal continuity summaries routed as ordinary public chat when the current chat locus was sticky, and #551 reported subagents publishing their plain text to the global fallback channel.

In the probe of the four modes that Tests describes, at main e85c57db9a, the disabled agent posted none of its plain text. But its channel_publish with no channelId, made in a heartbeat tick, posted to disc:guild:other, the channel the run's earlier messages came in on. Changing disabled would change what existing disabled agents meet, so this adds a mode instead.

Changes

• The mode. 'named' joins AgentConfig.proseRouting and Agent.proseRouting, with a doc comment in src/types/agent.ts.

• Plain text. A named agent's turn routes as a disabled turn does (turnModeOf, src/framework.ts:364), and gets no primer. Its completed speech and thoughts aren't dispatched to modules' speech handlers (:23049). Its sleep call posts nothing.

• The system line. For a named agent, each turn adds a system-position injection in the prose-routing namespace (:21353), from namedProseLine (:353). It reads, for an agent that may call channel_publish:

  Your plain text is never posted to any channel, in any turn. It stays in your own context, where this host's console and observers can see it. To say something in a channel or to a person, call a send tool and name where it goes: channel_publish with a channelId, or a tool that names a person or a message, such as a DM or reply tool.

  An agent that may not call channel_publish is pointed to "a tool that names a channel, a person or a message" instead. For a subagent (an ephemeral run), the second sentence says its final reply goes back to whoever started it and other plain text stays in its own context.

• Its tools.

  • channel_publish requires channelId, and its description says nothing is sent to a default channel.
  • skip_reply's description says to reply with a tool that names where it goes.
  • think drops the sentence about same-round routing.
  • sleep says nothing is announced, and drops announce and message.

  Other agents' descriptions are built from the same strings as before.

• The refusal. The channel registry refuses an agent-origin channel_publish with no channelId for a named agent, through a namesItsChannels option the framework passes (src/mcpl/channel-registry.ts:6157, src/framework.ts:29076). The refusal reads "Nothing was posted: channel_publish needs a channelId, since nothing is sent to a default channel. channel_list shows the channel ids." A named conversation fork's channel_publish with no channelId is refused too, not sent to the fork's home (:33227).

• A fork's drafts resend with no destination is refused for a named agent, instead of going to the fork's home (:18119).

• The receipt after a turn with plain text says how many plain-speech segments were "kept in your context, sent to no one (only a send tool that names where it goes reaches anyone)".

• A refusal by the provider of a named agent's turn gets no emoji reaction on the latest inbound message (reactToRefusal, :11173).

• The closed-channel invitation's first option, for a named agent that may call channel_publish, is a channel_publish call with the channelId that reaches that channel alone. Otherwise it says to check whether the server exposes a send tool that can address it. publishNameFor is taken out of publishRouteFor, which now calls it.

• Log lines. The NOT routed lines say why: a silent turn, or the configured mode.

• changelog.d/named-prose-routing.added.md, new.

• test/named-prose-routing.test.ts, new, with 13 tests.

Tests

Each of the 13 tests drives a named agent. Several also check that another agent meets what it did before.

• Plain text:
  • none is posted in a channel message's turn, a heartbeat tick's or a self-wake's, >> and >>> lines included, and no primer is given;
  • none reaches a module's speech handler, while another agent's still does;
  • its sleep call posts nothing, and it's told of no undeliverable reply.
• The system line:
  • it's in every turn's request, and in a turn's later provider rounds, through a real Membrane with membrane's Anthropic adapter building each wire request;
  • it names channel_publish only where the agent may call it;
  • a subagent's version says where its final reply goes.
• channel_publish:
  • with no channelId it's refused and posts nothing, with a serverId alone, with an empty channelId, from a script, and as an operator's puppeted call;
  • naming a channel posts there.
• Its tools agree with the rule, while another agent's say what they did.
• The receipt says nothing was delivered and the words stayed in its context.
• The invitation offers channel_publish naming the channel.
• The step that reacts to a provider's refusal (reactToRefusal, called directly) adds no emoji reaction for a named agent, while it still adds one for a locus agent.
• A conversation fork's channel_publish or drafts resend with no destination is refused, not sent to its home.

On Linux with Node 24.22.1, context-manager 0.23.1, membrane 0.8.0 and chronicle 0.4.0, in a clean checkout of e7b5489b90:

• The suite: tsc clean, then 8,806 tests, 8,744 pass, 0 fail, 62 skipped.
• With e85c57db9a's src/framework.ts, src/mcpl/channel-registry.ts, src/agent.ts and src/types/agent.ts: all 13 new tests fail.

The four existing modes. A probe drives a disabled, a locus, a hybrid and an explicit agent through the same steps, among them a plain reply, >> and >>> replies, and a heartbeat tick that calls channel_publish with no channelId. Its output records what each step posted, the window's rows, and the system and tool fingerprints of each of 21 requests. Run under Bun 1.4.4 with the same packages, at main e85c57db9a and at e7b5489b90, the two outputs are byte-identical.

Not verified

• A module's own channel_publish for a named agent, a callTool with module origin, isn't tested. The registry's refusal applies where origin?.kind === 'agent' (src/mcpl/channel-registry.ts:6157), and a module's callTool runs the call with { kind: 'module' } as its origin (src/framework.ts:4092).
• A shared window with agents in different modes. The closed-channel invitation is built for one agent, the woken agent or else the delivery agent (const invited = woken ?? this.deliveryAgent();, src/framework.ts:15702). An invitation written for a locus agent can ask for a reply with no prefix (src/framework.ts:15708 at this head), and one for a hybrid or explicit agent for one prefixed >>> or >> (:15726); a named agent's plain text, prefixed lines included, posts nothing. No test has residents in different modes reading one window.
• A switch into named mode on an agent that already ran in another mode isn't tested.
• previewActivation for a named agent isn't tested.
• main's fifth mode. main has since added proseRouting: 'locked' (src/types/agent.ts:344 at 0c570d8f2d, where e85c57db9a's :341 has four modes). Its doc there (:333–343) says unprefixed prose goes to one destination the agent chose with prose_locus, or proseLock until it chooses, and that a module that handles final speech itself, such as the in-process Discord module, receives it in every mode. That's a reading of the doc; neither the probe nor the tests ran at 0c570d8f2d.
• The framework's own Discord module. This change doesn't touch src/modules/discord/index.ts. At e85c57db9a it registers as the speech handler for every agent (:446), which is how a disabled agent's plain text reaches it: the speech dispatch's condition names no mode (src/framework.ts:22964). Its reply tool requires only content (:590–599 at this head), and sends to its reply context's channel (:1579–1581), so a named agent's discord--reply reaches a channel the call doesn't name. No test here runs the module.
• Platforms and providers. Every run here was on Linux. The tests use stand-in providers, apart from the later-rounds test's recording Anthropic adapter, which sends nothing. No run used a live provider.

[nissa-seru]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of e7b5489b9031.

Findings, most severe first:

• 1. should fix at src/framework.ts:15696, src/framework.ts:15712, src/framework.ts:15725, src/framework.ts:15694, src/framework.ts:15722, src/framework.ts:14975, src/framework.ts:15000, src/framework.ts:15702, src/framework.ts:14999: The shared closed-channel invitation uses one delivery agent's routing mode and permissions for every resident who reads it.
  • Failing case: With a locus or explicit delivery agent and a named resident sharing the window, an invitation addressed to multiple residents tells the named resident to reply in plain text or with a prose prefix; following that instruction posts nothing.
• 2. should fix at src/framework.ts:21353, src/framework.ts:9568, src/framework.ts:9523: previewActivation leaves out the named-mode system injection, which is added only at actual turn starts.
  • Failing case: For a named agent, previewActivation(name, { injections: true }) renders a request without the routing rule that the next actual turn includes, giving an operator an incomplete preview and token estimate.
• 3. should fix at src/framework.ts:18388, src/framework.ts:354, src/framework.ts:13754, src/agent.ts:2278, src/framework.ts:357, src/framework.ts:18389, src/framework.ts:22834: The named-mode line and receipt say text reaches no one, ignoring the shared message slot that other residents read.
  • Failing case: With two ordinary resident agents, one named agent writes plain speech without a send tool; the response is stored in the shared slot and the other resident can receive it in a later compiled request, despite the receipt telling the first agent that only a named send reaches anyone.
• 4. minor at src/framework.ts:4092, src/framework.ts:24363, src/mcpl/channel-registry.ts:6157, src/mcpl/channel-registry.ts:6173, src/types/agent.ts:458, changelog.d/named-prose-routing.added.md:10, commit-messages.txt:5, src/mcpl/channel-registry.ts:6172: Module-origin callTool skips the named-agent destination check and uses the default channel, contrary to the documented promise of no default destination.
  • Failing case: A module calls channel_publish on behalf of a named agent, identifying it in callerAgentName but omitting channelId; instead of refusing, the registry posts the content to defaultPublishChannel.
• 5. minor at src/framework.ts:21359, src/framework.ts:4629, src/framework.ts:30975, src/types/agent.ts:461, changelog.d/named-prose-routing.added.md:12, change-text.md:3, src/framework.ts:29022: The 'constant' named-mode system instruction changes depending on whether the channel registry has been initialized.
  • Failing case: Start a named agent with no MCPL servers and permission for channel_publish, run a turn, then connect the first MCPL server and run another turn: the instruction changes from generic send-tool advice to explicitly naming channel_publish, changing the system prefix between requests.
• 6. minor at src/mcpl/channel-registry.ts:6157, src/mcpl/channel-registry.ts:6160: The named missing-channel check catches an empty channelId before the empty-value refusal can run.
  • Failing case: A named agent calls channel_publish with content and channelId: "": it receives 'needs a channelId' rather than being told that the supplied channelId is empty.
• 7. minor at src/mcpl/channel-registry.ts:6158, src/framework.ts:342: The named publish refusal recommends channel_list without checking whether the agent is allowed to call it.
  • Failing case: An agent allowed channel_publish but not channel_list omits channelId; the refusal directs it to channel_list, but that remedy is denied by its tool allowlist.
• 8. minor at src/framework.ts:18388, src/framework.ts:10450, src/framework.ts:356: The named-mode receipt says speech reached no one, but runEphemeralToCompletion returns it to the subagent's starter.
  • Failing case: A named subagent ends with a plain-text answer: runEphemeralToCompletion returns the answer to its starter, while the stored receipt says the segment was sent to no one and that only a send tool reaches anyone.
• 9. minor at test/named-prose-routing.test.ts:182, src/framework.ts:21609, src/framework.ts:21353: No test checks that the system instruction is present on retries or on continuation and budget-restart starts.
  • Failing case: If a retry or continuation stopped adding the rule while ordinary turns and later rounds still added it, the named-routing tests would pass even though the subsequent provider request lacked the instruction.
• 10. minor at test/named-prose-routing.test.ts:317, test/named-prose-routing.test.ts:319: The sleep control's 500 ms wall-clock limit makes it flaky on loaded runners.
  • Failing case: Under CPU quota or a loaded runner, a correct locus announcement can be observed after 500 ms and fail the suite despite arriving within the polling helper's 15-second bound.
• 11. minor at test/named-prose-routing.test.ts:133, test/named-prose-routing.test.ts:134, test/named-prose-routing.test.ts:34: The self-wake test queues its response too late, so an early wake can eat the mock's empty fallback.
  • Failing case: If the one-second wake fires while the preceding turn is still settling or before the next helper call queues its response, the wake consumes the fallback completion and the following helper waits for a second request that never comes.
• 12. minor at src/framework.ts:15715, src/framework.ts:610, src/framework.ts:32944: The named invitation says replying opens the channel, but auto-open recognizes only certain tool names.
  • Failing case: A named agent without channel_publish follows the invitation and uses a server's differently named send tool to reply to a closed channel; the send may succeed, but the framework does not run its channel-opening flow, leaving the channel closed contrary to the invitation.

[nissa-seru]

/context-deltas

[anima-review]

Automatic context view of e7b5489b9031 against 0c570d8f2d8c.

What a context view runs and what its checks judge: CHECKS.md.

This head couldn't be compared: it doesn't merge onto 0c570d8f2d8c.